TL;DR: Tech debt is accumulated inside organisations. Toxic technology ecosystems emerge across markets, trapping vendors as surely as customers. The challenge is therefore not upgrading legacy systems, but rather restoring the conditions in which innovation becomes possible.

There is a well-known tech debt doom loop that many organisations find themselves caught up in, and then dragged down by. It works like this. A relatively short period of underinvestment increases the backlog of systems in an enterprise that require attention or renewal. The most urgently needed systems, critical to enterprise operation, start flashing red. Because resources are tight, a ‘quick fix’ or workaround is put in place and then frozen into architecture. The complexity of the system increases, making it progressively more difficult, and hence costly, to maintain or enhance.

A good deal of the remaining resource is consumed by vendor mandated upgrades. Either upgrade, or pay enhanced maintenance, or risk managing an unpatched system. It does not help that the original business case provided for acquisition but not for the costs associated with ownership.

Eventually, of course, the urgent squeezes out any strategic or innovative capacity, and the enterprise requires more and more to do less and less, entering a negative spiral.

AI has acquired its own version of the doom loop. All the critical enterprise data remain locked inside legacy systems that also mediate the core business workflows, so what little investment remains for driving change is spent on AI pilots, pathfinders, proofs of concept and demonstrations that have no realistic chance of scaling and wider deployment.

The tech debt doom loop would be bad enough on its own. It is, after all, avoidable and remediable. Organisations can, with determination and investment, dig themselves out. The deeper problem is that there are circumstances in which even well-managed organisations remain trapped because the market around them has ceased to function effectively. Tech debt is principally an organisational problem whilst what follows is a market problem.

Many organisations work in areas that require enterprise software systems to support deeply embedded services. An example to illustrate, in an area I am familiar with, is a student record system that helps higher education institutions manage the key student data and associated workflows such as admissions.

These systems often have long lineages stretching back to the time when the idiosyncratic ‘manual’ business processes in each organisation were initially brought online. At that stage the existing models and workflows were implemented in heavily crafted software systems. It was difficult to envisage doing anything else. Subsequent technical evolution resulted in large database-centric systems surrounded by a dense thicket of bespoke code, scripts and interfaces to other systems. It seemed a sensible architecture at the time, and in any case there were not many choices. A lot of investment got locked into the systems, and they became more and more complex and difficult to change.

Each customer gradually accumulated a unique version of the software, with its own data model, customisations and upgrade history. As discussed above, change became more difficult and the system became more bottlenecked around data access, prompting ad-hoc engineering fixes. This was obviously bad for the customers who could not step away and were naturally reluctant to disrupt processes that were critical but not delivering much direct business value.

It turns out that this is not only bad for customers, it is bad for vendors too. At first it might have appeared that all was good. Customisation generated revenue and increased customer dependence, but it also transformed software companies into labour-intensive service businesses, with all the attendant problems of scale and productivity. After a time, margins increasingly depended on services rather than product innovation, and investment gradually drained away from the platform itself. In some cases financial ownership further reinforced short-term optimisation at the expense of product renewal.

Normally, this is the point at which a new entrant should disrupt the incumbents. In these markets that rarely happens. Switching costs have become so high, implementation so risky and procurement cycles so long that superior products struggle to gain adoption. Competition no longer disciplines suppliers because customers can no longer exercise meaningful choice.

Of course, there is a further consequence. Instead of managing one product, the supplier gradually finds itself maintaining many subtly different products. Configuration management substitutes for product engineering, testing becomes more expensive, upgrades become slower and innovation atrophies.

This is where the problem ceases to be simply one of tech debt and becomes instead one of market structure and dysfunction. Healthy software markets compete by building better products. Toxic technology ecosystems compete by making it harder to leave. Innovation is less profitable than customer retention. Suppliers become increasingly dependent on servicing the installed base rather than renewing the platform, while customers become progressively more dependent on suppliers who have fewer and fewer incentives to innovate. The customers are locked in and so in some sense are the vendors.

The result is a toxic technology ecosystem: customers cannot leave and vendors cannot innovate. New entrants cannot readily break in. Technical debt is accumulated inside organisations but the adverse effects of toxic technology ecosystems accumulate across markets. Tech debt is something an organisation might eventually repay, ecosystem toxicity however is something no organisation can fix on its own.

The answer is not simply to replace one legacy platform with another but rather to reduce the value of lock-in itself. That means simplifying business processes rather than endlessly reproducing historical complexity and agreeing open data standards so that information can move. It means stable interfaces and reference architectures that allow components to be replaced independently and separating data from workflow, so organisations retain ownership of one without being captive to the other.

Ironically, restoring competition requires collaboration. Individual customers negotiate contracts but collectively they can shape markets. When every organisation demands bespoke functionality, every supplier becomes a consultancy. Once organisations converge around common standards, reference architectures and genuinely distinctive requirements, suppliers can compete on the quality of their products rather than on the depth of customer lock-in.

Technology ecosystems become toxic when nobody can afford to change. The only available strategy to address this is to restore the conditions and rebuild the markets in which innovation becomes possible.

TL;DR: It is too hot for @profserious to be entirely serious.

I left almost all WhatsApp groups some years ago, and have been excluded from the group where larger family arrangements are made on the justifiable grounds of administrative incompetence. The original reason for, and moment of, my departure from collective communication of this form stems from the time, some years ago, when I received an email, at a moment of peak work stress and complexity, from violetbutterfly1@yahoo.com. Apparently violet butterflies represent a spiritual connection to higher realms but, on this occasion, the address belonged to a parent on my children’s school email list. She informed me that her daughter Marsha had left her pants at the swimming pool. I am distantly aware that Marsha, now adult, has gone on to a career of some distinction, despite the loss of her pants. I dare say she can now afford to replace them.

Collective communication of this form is not generally my thing. I do not subscribe to the neighbourhood WhatsApp group but J keeps me up to date. So, for those who like me are disconnected, but do not wish to appear unconcerned with local matters, here are the 10 top insights:

• ‘Does anybody know a good plumber?’
  Yes. Lots of people know a good plumber but none of them know how to spell his name. See list of comic misspellings of Polish names.

• ‘Does anybody know a good local garage to repair my car?’
  No. Obviously nobody knows a good local garage they are all cowboys.

• ‘I have left some books in a box outside my house. Please take any that interest you.’
  You do not need the Good Pub Guide 2016.

• ‘Have you seen Fluffy the cat? She is lost from No. 46.’
  No. Fluffy is not lost. She is being fed by the 13-year old girl at No. 48. I have seen her on instagram.

• ‘There are suspicious people lurking at the bench on the corner. I think they are drug dealers.’
  Those are what is known as ‘young people’, they are waiting for their friends.

• ‘Be aware, there are cats getting tickets in the adjacent road.’
  Clearly, cars rather than cats are getting tickets but nevertheless hilarity ensues.

• ‘There are Lime bikes littering the pavement outside our house. The Council should do something.’
  Yes, your son and his friends parked them there. Next time you can take the 4x4 and pick them up from football.

• ‘Does anybody have a reliable recipe for honey cake?’
  This is Hampstead Garden Suburb ... everybody has a recipe for honey cake. None of them beats Florence Greenberg (except J’s, and she is not telling).

• ‘I am having trouble with my Windows Vista computer. Can anybody help?’
  Yes, you are, and no they cannot.

• ‘Please remember this is not a political group.’
  23 replies later, everybody agrees that the video of the local councillor apparently throwing an organic waste bin into a skip was AI-generated. Nobody agrees on anything else.

I occasionally wonder whether I should, after all, join. There is undoubtedly a great deal of kindness beneath the other stuff. Cats are found, neighbours rally round, recommendations are exchanged, lost property returns home and, every so often, somebody really does know a good plumber. Endlessly repetitive, sometimes absurd, occasionally irritating but, on balance, rather decent.

TL;DR: The Committee of University Chairs (CUC) Code of Higher Education Governance raises expectations of university governing bodies and strengthens oversight in sensible ways. But universities face a challenge that extends beyond assurance – institutional transformation. Governing bodies need to become partners in strategic adaptation, supported by renewed academic governance. Governance must evolve beyond assurance if universities are to preserve both their academic purpose and their public legitimacy.

The Committee of University Chairs (CUC) has published a new Code of Higher Education Governance intended to set expectations for governing bodies. I would not be surprised if you had not noticed this. If you are engaged in university leadership it should have reached your inbox, though perhaps not your reading list.

It is, I think, a thoughtful and largely unexceptionable document, understandably concerned with the mechanics of governance. It places considerable emphasis on financial resilience, sustainability, assurance and risk. It also acknowledges the importance of public trust, what I have elsewhere described as a university’s social licence. It treats this, however, largely as an outcome of good governance rather than as something governing bodies themselves must actively cultivate. I judge this to be a key shortcoming. Universities derive their authority from sources beyond regulation. Students, employers, governments, local communities, funders and taxpayers each form their own judgement about whether universities continue to justify the autonomy they enjoy. Governing bodies therefore have responsibilities extending beyond financial stewardship. They are necessarily custodians of institutional legitimacy.

The central effect of the Code as it stands is to raise the expectations placed upon governing bodies and to extend their responsibilities in relation to executive management. It is not explicit about an expanded model of board accountability, but that expansion is implicit throughout the Code. Governing Bodies are expected to satisfy themselves on an ever wider range of institutional activity. Responsibility has increased although authority has not.

I am not entirely sure that, in the present circumstances, I would choose to become a non-executive member of a university governing body. Many years ago I served on an NHS board. Meetings consisted largely of reviewing risks, many of which had no realistic mitigation available either to the board or, for that matter, to the executive. Responsibility far exceeded practical control; it was not an experience I would care to repeat.

As financial, regulatory and reputational pressures increase, governing bodies naturally seek additional assurance. The easiest route is more reporting, more scrutiny and greater involvement in executive activity. That response is entirely understandable. It is also capable of changing the relationship between governing body and executive in ways that reduce clarity of responsibility and slow institutional adaptation.

The governance arrangements that most universities have inherited were developed for institutions operating within relatively stable assumptions about funding, regulation, technology and public expectations. The current situation of UK universities is not ‘business as usual’. We are resting on the cusp of a period of major disruption. Our operating models, workforce, and academic activities – both research and teaching – require wholesale transformation. Student expectations continue to evolve. The configuration of the sector is set for substantial change through mergers and consolidation. We must navigate all of this with very limited financial headroom, constrained capital investment and uncertain public and staff support.

Greater assurance undoubtedly has value. It improves visibility of risk and strengthens accountability. It also consumes organisational capacity and can reduce agility. Most governing bodies were not designed to lead fundamental organisational redesign. That requires different expertise, different rhythms of decision-making and a different relationship between governing bodies and executive.

Nor is the coming transformation primarily a governance problem. It is a strategic and technological one. Universities are becoming increasingly digital organisations. AI will reshape universities from admissions through curriculum design to research practice, professional services and student support. Its effect on institutional behaviour is likely to exceed that of any governance reform. Governing bodies therefore require confidence in technology and institutional transformation alongside the more familiar disciplines of finance, audit and risk.

The Code gives greater prominence than its predecessors to academic governance, and properly so. Universities are not ‘corporations’ delivering services. Our academic communities are central to legitimacy, quality and long-term success. Effective governance therefore depends upon a productive relationship between governing bodies, executive leadership and academic governance. Assuring academic standards is necessary but not sufficient; we need to ensure that academic judgement plays a formative role in institutional strategy and adaptation. This suggests that current models of academic governance have a great distance to travel.

If the sector is to respond successfully to the challenges ahead, governance itself must evolve. The relationship between governing bodies and executive should be characterised by trust, delegation and strategic partnership rather than incremental extension of oversight. Governing bodies should concentrate on purpose, long-term strategy, institutional capability, risk appetite and stewardship. Executives should retain the authority and freedom necessary to deliver change at pace. Academic governance should be renewed and strengthened as an essential component of institutional leadership rather than regarded principally as an assurance mechanism.

The next phase of university governance will not be defined by stronger audit committees or more comprehensive reporting. It will be defined by whether governing bodies can help universities navigate profound institutional transformation whilst preserving their academic purpose and public legitimacy. Another dashboard, a few more KPIs, or a longer risk register just will not cut it.

TL;DR: Systems dynamics and control provides a framework for understanding why complex systems behave as they do. Its central insight is that behaviour emerges from structure. Feedback, delays, accumulations and constraints are more important than the characteristics of individual components. These ideas originated in engineering, but they illuminate the behaviour of organisations and institutions as readily as they explain physical and technological systems.

I know that @profserious articles cover a wide range, and it may be that if you are interested in higher education you are less interested in national security, or if you subscribed to read about emerging technology then articles about policy are unwelcome. But, I would like you to trust me on this, whichever of these is your primary concern, this article is for you.

There are some things you learn that change the way you see the world. Once introduced to them it becomes difficult to think in quite the same way again. For me, learning about systems dynamics and control is one of those intellectual inflection points. It provides a language for understanding why complex systems behave as they do and, in doing so, changes the questions one asks about almost every problem.

1. Structure drives behaviour. Systems dynamics starts from a simple proposition that has profound consequences. Behaviour is generated primarily by the structure of the system rather than by the properties of the individual components. Structure comprises the network of reinforcing and balancing feedback loops, together with the constraints and relationships between different parts of the system. Similar structures often produce similar patterns of behaviour regardless of the characteristics of the components. This implies a different way of analysing persistent problems. Rather than asking why specific components fail to achieve their goals, this approach asks instead what features of the system generate the undesirable behaviour.

2. Stocks are not flows. A stock is an accumulated quantity. A flow is the rate at which that quantity changes. Stocks therefore change only through the net effect of their inflows and outflows, which means that flows can change immediately while stocks can only change over time. This distinction, although straightforward, is nevertheless frequently misunderstood. Implicitly confusing rates with accumulations gives rise to systematic underestimates of the inertia inherent in complex systems.

3. Feedback entails delay. Feedback is what distinguishes a dynamic system from a passive one. Reinforcing feedback amplifies change, whilst balancing feedback opposes it and tends towards stability. In practice, however, feedback is almost always subject to delay arising from sensing, communication, decision-making or physical processes. Those delays alter the behaviour of the system and can transform stable control into instability if corrective action consistently arrives too late. Much of control theory is concerned with understanding how feedback and delay interact to determine system behaviour.

4. Real systems are nonlinear. Many analysis techniques – and common intuitions – begin by approximating a nonlinear system with a linear one because linear systems are tractable and often provide a good approximation over a limited operating range. The approximation eventually fails because real systems contain thresholds, saturation effects, discontinuities and multiple operating regimes. As a consequence, proportional changes in input do not necessarily yield proportional changes in output, and small changes in conditions can sometimes produce qualitatively different patterns of behaviour. The most interesting and important behaviour of complex systems frequently occurs precisely at those points where linear intuition breaks down.

5. Disturbances are often amplified. Systems composed of multiple interacting stages frequently amplify rather than attenuate disturbances. Delays, local decision-making and imperfect information mean that a small variation introduced at one point can become progressively larger as it propagates through the system. The resulting behaviour is often counter-intuitive because actions that appear locally rational can collectively increase overall instability.

6. Closed-loop systems compensate. Feedback systems often maintain their behaviour in the presence of disturbance. Attempts to change their behaviour are therefore frequently interpreted as disturbances and are partially or wholly compensated by existing feedback mechanisms. Consequently, altering the magnitude of an intervention often produces less change than expected because the system itself responds to preserve its existing mode of operation.

7. Measurement changes behaviour. Feedback control depends upon measurement, but once a measured variable becomes the basis for decision-making the system begins to optimise that variable rather than the underlying objective it was intended to represent. The statistical relationship between the measure and the objective consequently changes, often reducing the usefulness of the measure itself. It is a general property of feedback systems that the act of control alters the behaviour being measured. Targeting a proxy hollows out its value as a measure (popularly, Goodhart’s law).

8. Every controller embodies a model. Every controller operates according to assumptions about the behaviour of the system it regulates (as in the Conant–Ashby theorem). Some of those assumptions are explicit in mathematical models, while others are implicit in rules or policies. Since no model captures reality perfectly, the performance of a controller depends upon the extent to which its assumptions remain valid. Differences between the assumed model and the actual system frequently explain unexpected or degraded behaviour.

9. Performance always involves trade-offs. Control systems cannot simultaneously maximise every desirable characteristic. Increasing responsiveness generally reduces stability margins, while increasing damping suppresses oscillation at the cost of slower response. Improving sensitivity often increases susceptibility to noise. These relationships are fundamental properties of dynamic systems rather than shortcomings of particular designs. They arise because the underlying dynamics constrain which combinations of behaviour are simultaneously achievable.

10. History influences future behaviour. The behaviour of many systems depends not only upon their current state but also upon the path by which that state was reached. This is known as hysteresis. Once a system has crossed certain thresholds, simply removing the original cause does not necessarily restore the prior behaviour because the system has entered a different region of operation. The present observable state therefore does not always contain sufficient information to predict future behaviour without knowledge of the past.

11. Bonus: Complex systems are steered rather than controlled. As systems become more complex, complete knowledge of their state and complete authority over their behaviour become unattainable (Ashby’s law of requisite variety makes this limit explicit). Their evolution emerges from many interacting feedback processes operating at different scales. Consequently, interventions influence rather than determine behaviour, shaping the conditions under which some outcomes become more likely than others.

Systems dynamics and control is not simply an engineering discipline; it is a way of thinking about complex systems wherever they occur. The significance lies less in the mathematics than in the analytical framing they permit. They have shaped the way I view technology, policy and institutions, and how I approach building solutions to complex challenges. I commend these 10(+1) lessons to you.

TL;DR: Mid-career can be a trap: the next grant, paper, promotion or metric. Reinvention begins when you stop asking what comes next and start instead asking what is now possible. Here are 10 ways for mid-career academics to recover curiosity, take risks and liberate themselves.

A short while ago I wrote an article, On Choosing an Academic Career, that has been generally well received. Amongst the small number of critical comments was however one that struck a particular chord: given the difficulties of securing academic roles, perhaps I should instead attend to the mid- and late-career academics, many of whom are feeling the pressures of a sharply competitive profession in an increasingly demanding environment.

I may, at some point, write about late-career choices, but at this moment it seems too immediate and intimate. I can, however, look at mid-career academia through the rear-view mirror. I recall its highs and lows and have now been a manager, and sometime career mentor, for long enough to offer a perspective.

Mid-career in academia often opens with a critical moment: promotion to a (full) professorship … or not. For many, the process of securing promotion reflects what might be termed a moment of peak professional anxiety. Everything seems to lead up to this. For those who experience rejection or, more commonly, who do not reach the bar at which their application receives sufficient support to proceed, it is a moment for difficult questions. They are too invested in the career simply to abandon it, but perhaps unable to access the rewards and esteem they expected. Mid-career is, of course, also marked, for many, by a press of personal, familial and financial demands that accentuate the highs and lows of academic life.

It is tempting to address the issues surrounding promotion and, as with my late-career musings, I may return to them in the future. I want, however, to speak instead to the period immediately following that long-sought promotion. Because so much attention has been focused on reaching this point, the question becomes: what now?

This can be a critical moment intellectually, personally and in terms of what you can achieve. You can be successful by conventional measures and still under-fulfil your potential. The danger is that promotion becomes an end point rather than a beginning. The suggestions that follow are all, in different ways, attempts to break patterns of professional habit, recover curiosity and create opportunities for reinvention.

Here are 10 @profserious suggestions for necessary liberation and re-invention.

Teach a New Course. Offer to teach the course you missed in your own education. Something that is now outside your own area of expertise and that will require you to go on a rapid learning journey.

Attend a Different Conference. Go to a conference in a different area simply as an attendee. Be there to listen, learn and make friends. See other communities at work. Be a stranger, not an insider.

Take a Mini-Placement. Spend a few weeks embedded with an industrial, business, civil-society or arts partner on their premises, working on one of their most pressing challenges.

Pursue the Big Question. Apply for a fellowship and pitch the biggest, most open and most uncertain question in your area. Lean as far into risk and imagination as you can. Start today. Make it as compelling as possible and set aside any thought that you might be unsuccessful.

Build the Start-Up. Turn that idea for a start-up into a reality. Sketch the pitch deck and begin work today on your proof-of-concept build.

Engage with Policy. Look for the government policy area that most needs your expertise. Work out where the policy debate lies and who the key actors are. Talk to the think tanks and policy professionals working on the area and attend to the political arguments while seeking to understand their motivations. Bring your expertise to bear in shaping emerging proposals.

Change a Process. Identify the most annoying process in your university and set out to change it. Find out why it is in place, identify the key stakeholders, develop options and navigate the means for getting your changes realised (even if that requires assuming unwelcome responsibilities).

Talk to Schools. Give some talks in your university’s schools programme. Work out how to enthuse young people about your subject and, along the way, rediscover what first made you love it.

Seek Out Leaders. Seek out the 3 most influential people in your area of work. Email them and ask for a coffee and a conversation. Ask for their advice on directions, opportunities and career choices.

Mentor and Sponsor. Start mentoring and sponsoring. Remember that you can shape careers and create opportunities. Pass on what you have been given.

None of these suggestions is really about career advancement. Indeed, that is really the point. Mid-career academia can become dominated by optimisation: the next grant, the next paper, the next promotion, the next metric. Yet the greatest advantage of this stage of a career is that you have already demonstrated your capability. You have earned the right to take risks, to explore, to contribute in new ways and to help others succeed. Reinvention - and liberation - begins when you stop asking what comes next and start instead asking what is now possible.

TL;DR: Emergencies are digital. The evidence from pandemics, natural disasters, and war suggests that successful digital responses depend less on technology than on preparation, governance, trust and operational experience. The UK should treat digital preparedness as a core component of national resilience rather than something assembled in the midst of a crisis.

I have wanted to write this for some time. It stems from my experience during the COVID-19 pandemic, and I hope you hear the voice of that experience. It is, however, intended to have a broader scope and, beyond that, to establish the case for a UK national digital emergency capability.

The response to every major civil emergency seems to reveal the same characteristic weaknesses. Information is incomplete or contradictory and organisations struggle to share their data. Resources cannot easily be located, or directed to where they are most needed. Citizens find it difficult to discover what is happening, what assistance is available, what they should do next, and how they might contribute to mitigation. We generally describe these as failures of communication or coordination, and of course they are, but they often stem from failures of digital capability.

In everyday life, we communicate digitally, access services digitally, monitor infrastructure digitally, navigate physical space digitally. Increasingly decisions are digitally mediated. Yet much of our thinking about emergencies and resilience is rooted in a more physical conception of crisis. We tend to think about stockpiles, emergency services, vehicles, buildings and equipment. These things obviously remain essential, you cannot readily digitally substitute for a flood barrier, an ambulance crew or a functioning electricity grid. But almost every serious emergency response now has a digital component and, increasingly, that component determines the overall effectiveness of the response.

The evidence from recent emergencies is consistent - digital capabilities can materially improve outcomes. During the COVID-19 pandemic, Taiwan drew upon pre-existing digital infrastructure, public-health systems and civic-technology networks to support rapid public communication and service delivery. When concerns emerged about mask availability, digital services appeared quickly because the underlying data and governance arrangements already existed.

Ukraine’s digital resilience has similarly rested on foundations laid before the Russian invasion. The Diia platform, originally developed as a digital-government service, became a mechanism for distributing assistance, maintaining access to public services, reporting damage and supporting displaced citizens. Estonia’s long investment in digital government has proved valuable not merely for efficiency but also for resilience. Japan’s earthquake early-warning systems and New Zealand’s GeoNet monitoring network illustrate the same principle in different contexts. Long-term investments in digital infrastructure, information systems and operational capabilities can become critical assets during periods of disruption.

I am conscious that successful cases attract disproportionate attention, and Taiwan, Estonia and Ukraine are extensively studied because they are widely regarded as successes. We know less about the routine performance of digital emergency capabilities during smaller and less visible events. Nor can successful examples simply be copied. Taiwan’s experience reflects particular social, political and institutional conditions, including strong civic-technology communities and relatively high levels of public trust. Causation is often difficult to establish, digital systems typically operate alongside many other interventions. It is rarely possible to determine precisely how much of a successful outcome should be attributed to technology rather than leadership, resources, public behaviour or institutional competence. None of these caveats, however, undermine the primary argument that digital capabilities are critical to emergency response.

Evidence

We have accumulated evidence from pandemics, earthquakes, floods, industrial accidents, cyber attacks and armed conflict across a range of societies and institutional settings. The details differ but the underlying findings are remarkably consistent.

Preparation. Successful capabilities almost always predate the emergency. Systems embedded in everyday operations prior to a crisis outperform those assembled during one. Technology can often be procured quickly but trust, governance, institutional relationships and operational experience generally cannot.

Interoperability. Emergencies cut across organisational boundaries. Data, decisions and services must flow between organisations that often operate independently in normal circumstances. The most effective responses rely upon common standards, agreed interfaces and established mechanisms for information sharing.

Trust. Citizens will not use services they do not trust, nor act on information they do not believe. Trust is often discussed as a cultural phenomenon but it is also an engineering and governance challenge. Transparency, accountability, privacy protections and clear communication all influence effectiveness. A technically elegant solution that lacks public trust is usually an operational failure. It needs to be said, however, that public trust and the voice of the more ideological privacy advocates do not always coincide.

Inclusion. Emergency services that assume universal digital access systematically exclude parts of the population. Older people, vulnerable groups, those with disabilities, rural communities and those with limited digital skills are often precisely those most in need of assistance. Research on emergency cash-transfer programmes during COVID-19 found that mature digital infrastructure enabled assistance to reach citizens more rapidly, but the most successful systems also retained non-digital channels for those unable to access digital services.

Experience. Emergency response is a practical discipline. Systems must be exercised and organisations must understand their roles. Procedures must be tested under realistic conditions. Technologies frequently fail not because they are defective but because organisations have never practised using them under pressure.

One of the most instructive examples comes from the Fukushima nuclear accident in 2011. Japan possessed a radiation-dispersion modelling system, SPEEDI, developed specifically to support nuclear emergencies. The software functioned as intended, yet information was delayed because responsibilities were unclear and outputs were not effectively integrated into operational decision-making. The broader capability did not function as intended.

The same lesson appears elsewhere. Social-media platforms proved invaluable during disasters such as Hurricane Harvey, helping communities coordinate rescue activities when formal channels were overwhelmed. Yet success depended not merely on the existence of the platforms but on the communities, relationships and practices that had developed around them. Drone technologies have repeatedly demonstrated value in damage assessment, search and rescue, infrastructure inspection and the delivery of supplies. Yet effectiveness depends heavily on operator skills, regulatory arrangements and integration with emergency services. In short, digital emergency preparedness is as much about institutional capability as technology.

Foundations

Preparedness does not require a bespoke solution for every conceivable emergency.

The UK National Risk Register catalogues a diverse set of risks: pandemic disease, flooding, industrial accidents, terrorism, cyber attacks on critical infrastructure, major infrastructure failure, severe space weather, and so on. The scenarios differ enormously but many of the digital capabilities required to address them are remarkably similar. All require some combination of public communication, situational awareness, resource allocation, service access, identity management, information sharing and operational coordination.

The technologies may differ at the margins, but the underlying capabilities are often the same. Preparedness should therefore be understood less as a collection of emergency-specific systems and more as a portfolio of reusable assets.

Some of these assets are technical: common data architectures, interoperable platforms, mapping and geospatial services, sensor-integration frameworks, secure communications, identity and access-management systems and mechanisms for rapidly creating citizen-facing services. Others are organisational: governance arrangements, procurement frameworks, data-sharing agreements, relationships with critical suppliers and established operating procedures. Still others are human: skills, experience, institutional knowledge and professional networks.

Security, ethics and public trust cut across all three categories. Emergency systems become particularly attractive targets during periods of disruption. Difficult questions concerning privacy, proportionality and the use of personal data inevitably arise. These issues are far easier to address before an emergency than during one.

Digital preparedness should resemble other forms of civil preparedness. We do not maintain separate capabilities for each emergency type; rather, we maintain adaptable capabilities that can be deployed in different circumstances. The same principle should apply to digital emergency response.

Lessons

My own experience during the COVID-19 pandemic is wholly consistent with these observations. I was involved in work on what became the NHS contact-tracing app. Reflecting, the challenge was not principally technological, despite the novel engineering involved and the pace at which it was undertaken.

Teams had to be assembled and governance arrangements established. Procurement was accelerated, security assessed and data-sharing arrangements set in place. Relationships were created, or at any rate crudely assembled, between organisations that had not previously worked together. Important decisions were taken under intense public scrutiny and considerable time pressure. The programme demonstrated both what can be achieved during a crisis and the limitations of creating and deploying capability simultaneously. The app ultimately helped reduce transmission and save lives, but much of what was required could, and should, already have existed. We improvised successfully in many areas, however, we should not mistake successful improvisation for preparedness.

Preparedness

We tend to think of emergencies primarily as physical events; increasingly, they are also information events. Misinformation, rumours, speculation, and uncertainty can trigger unintended behaviours. Social media enables communities and volunteers to organise rapidly, but can also amplify confusion. The World Health Organisation’s adoption of the concept of an ‘infodemic’ reflects its recognition that information environments can directly influence emergency outcomes.

The lesson is, obviously, not that governments should control information even were that possible. It is that trusted channels, established relationships and the ability to communicate clearly and quickly are themselves components of preparedness. This is likely to become more important rather than less. AI may improve our ability to analyse information and identify emerging problems. Equally, it is set to increase the volume and sophistication of misinformation. Whatever the balance ultimately proves to be, information environment management can no longer be treated as a peripheral activity. The digital capabilities that support it are vital.

Emergency response increasingly depends upon privately owned infrastructure. Cloud providers, satellite operators, telecommunications companies, mapping providers, software companies and social-media platforms all play operational roles during crises. This is not inherently problematic, and governments benefit enormously from private-sector capability and innovation. It does, however, create new dependencies. Critical elements of emergency response increasingly rely on organisations whose governance, incentives and accountability arrangements differ from those of the state. We need to catch up with the challenges this presents.

Ukraine provides perhaps the clearest illustration. Satellite communications have become a critical component of national resilience. Cloud providers supported continuity of government systems. Private technology firms contributed cyber-defence capabilities and operational support. A different lesson came from the Apple/Google Exposure Notification API, shaped by their commercial interests, which effectively dictated the architecture of contact-tracing applications internationally and demonstrated the influence that private technology firms can exert during emergencies.

Capability

The UK would benefit from a standing national digital emergency capability. This would not be another emergency-response organisation sitting alongside existing responders. We already possess extensive operational emergency capabilities; the gap lies in the digital foundations that increasingly support them.

The objective would not be to build a bespoke digital system for every scenario in the National Risk Register. That would be impractical and largely unnecessary. The evidence suggests that many emergencies rely upon a common set of underlying capabilities assembled in different ways. A UK capability would steward, maintain and exercise the reusable assets on which emergency response increasingly depends. It could maintain shared digital infrastructure such as secure communications, mapping and geospatial services, situational-awareness platforms, citizen-facing service capabilities, identity-management systems and frameworks for integrating information from multiple sources.

It could also maintain the less visible but equally important foundations of effective response: reference architectures, interoperability standards, data-sharing frameworks, procurement mechanisms, framework contracts, supplier relationships, security-assurance processes, privacy protections, ethical guidelines and governance arrangements.

A standing network of specialists drawn from government, industry, academia and the voluntary sector could preserve skills, relationships and institutional memory between emergencies. The objective would not simply be to retain expertise but to ensure that people who may need to work together during a crisis already know one another and understand the relevant frameworks.

The capability would support training, exercises and professional development. Research shows that technologies often fail, not because they are defective but because organisations have never practised using them under realistic conditions. Exercises should therefore test not only systems but governance, communication, organisational coordination, private-sector dependencies and decision-making under pressure.

Security would be treated as a core design principle rather than an afterthought. Emergency systems become especially attractive targets during periods of disruption. Architectures, contracts, operational procedures and exercises would therefore incorporate security from the outset.

The National Risk Register does not ‘predict’ the future; rather, it identifies plausible futures. Some of the emergencies it describes will never occur but others almost certainly will. A UK national digital emergency capability could ensure that, whatever emergency occurs, the digital foundations of the response already exist.

Conclusion

Resilience is rarely created at the moment it is needed. It is accumulated over time through investment, preparation, practice and institutional memory. We understand this instinctively when it comes to flood defences, emergency services and critical infrastructure. The digital capabilities that increasingly underpin emergency response should be treated no differently.

The argument here is not about technology but rather about preparedness. Communication, coordination, information management and service delivery increasingly depend upon digital capabilities. As those functions become more digital, so too does resilience. Our goal should be to ensure that, whatever form an emergency takes, the capabilities on which an effective response can be built already exist.

TL;DR: I bought ‘A Child’s Garden of Verses’ for G.

My parents would read me poetry at bedtime. More accurately, my father would recite, my mother would read. My father’s recitations generally opened with the Polish Romantic epic ‘Pan Tadeusz’ by Mickiewicz that begins:

Lithuania! My Homeland! You are like good health:
Only he learns how precious you are
Who has lost you. Today I am able to see — and describe in writing —
Your full beauty, precisely because I miss you.

The distinctive rhythm, that of my childhood, is more obvious in the Polish in which, naturally, it was recited:

Litwo! Ojczyzno moja! ty jesteś jak zdrowie:
Ile cię trzeba cenić, ten tylko się dowie,
Kto cię stracił. Dziś piękność twą w całej ozdobie
Widzę i opisuję, bo tęsknię po tobie.

The English Romantic poets followed; Coleridge’s ‘Kubla Khan’ flowed and surged:

In Xanadu did Kubla Khan
A stately pleasure-dome decree:
Where Alph, the sacred river, ran
Through caverns measureless to man
Down to a sunless sea.
So twice five miles of fertile ground
With walls and towers were girdled round;
And there were gardens bright with sinuous rills,
Where blossomed many an incense-bearing tree;
And here were forests ancient as the hills,
Enfolding sunny spots of greenery.

And then the breathless charge of Byron’s ‘The Destruction of Sennacherib’, my father’s favourite:

The Assyrian came down like the wolf on the fold,
And his cohorts were gleaming in purple and gold;
And the sheen of their spears was like stars on the sea,
When the blue wave rolls nightly on deep Galilee.

Like the leaves of the forest when Summer is green,
That host with their banners at sunset were seen:
Like the leaves of the forest when Autumn hath blown,
That host on the morrow lay withered and strown.

And though I scarcely understood the poems and their resonances, Pan Tadeusz not at all, I could hear the echoes of the military marches that my father loved. And perhaps, distantly, of the moments, as he waded ashore at Pahlavi in Iran in 1942, and that he knew he might live, and they sang a patriotic hymn: ‘Lord who Saved Poland in Ages Past’:

O Thou Lord God, who for so many ages
Didst give to Poland splendour and might
Who shielded her from storms’ wild rages
And kept her ever in Thy holy sight.
Father, we kneel to plead before Thy throne,
Give to us freedom, give to us our own!

Boże, coś Polskę przez tak liczne wieki
Otaczał blaskiem potęgi i chwały,
Coś ją osłaniał tarczą swej opieki
Od nieszczęść, które przywalić ją miały.
Przed Twe ołtarze zanosim błaganie,
Ojczyznę wolną racz nam wrócić, Panie!

Perhaps this was one of the songs he sang in the car as we headed on holiday, and my grandmother turned to look out of the window.

My mother read. Principally, ‘A Child’s Garden of Verses’. Because of G, I have retuned to it, though, of course, it has somehow always been with me. It opens with the moving dedication to Stevenson’s nanny, Alison Cunningham:

For the long nights you lay awake
And watched for my unworthy sake:
For your most comfortable hand
That led me through the uneven land:
For all the story-books you read:
For all the pains you comforted:

For all you pitied, all you bore,
In sad and happy days of yore:—
My second Mother, my first Wife,
The angel of my infant life—
From the sick child, now well and old,
Take, nurse, the little book you hold!

And it closes with ‘To Any Reader’:

As from the house your mother sees
You playing round the garden trees,
So you may see, if you will look
Through the windows of this book,
Another child, far, far away,
And in another garden, play.
But do not think you can at all,
By knocking on the window, call
That child to hear you. He intent
Is all on his play-business bent.
He does not hear; he will not look,
Nor yet be lured out of this book.
For, long ago, the truth to say,
He has grown up and gone away,
And it is but a child of air
That lingers in the garden there.

As I look now, though the poetry speaks to the child, it is the adult that leads one into, and out of, the garden.

I read to my own children, I recall Belloc’s ‘The Yak’:

As a friend to the children commend me the Yak.
You will find it exactly the thing:
It will carry and fetch, you can ride on its back,
Or lead it about with a string.

The Tartar who dwells on the plains of Thibet
(A desolate region of snow)
Has for centuries made it a nursery pet,
And surely the Tartar should know!

Then tell your papa where the Yak can be got,
And if he is awfully rich
He will buy you the creature—or else he will not.
(I cannot be positive which.)

It had a contemporary coda, I cannot determine the source:

We’re very depressed with our yak,
Which has now become terribly slack.
It cleaned the kitchens and stairs
Better than many au pairs,
But now we have to take our yak back.

But for G, it is to the garden I return, drawing as near as I can to the ‘child, far, far away’ that is me. I am grown up, but not gone away.

TL;DR: Quantum computing is becoming more plausible but further progress is unpredictable. Advances in error correction have strengthened the case that, at least in principle, large-scale machines may eventually be built, yet the range of important problems they will solve remains uncertain. For the moment, post-quantum cryptography and quantum sensing appear more immediate than any promised computational revolution.

Quantum computing occupies a curious position in public discourse. Many people know enough to have heard of qubits and quantum supremacy (but in any case do not worry, I will explain). Quite a few will have heard that quantum computers will break encryption. It is the poster child of emerging technologies: governments announce national strategies, venture capital flows, and technology companies release high-profile demonstrations. In the imagination it promises unbounded, low-energy compute and the capability to solve a wide range of complex problems that are beyond the reach of existing computational methods. The technology is, in this account, protean and its arrival is imminent.

As a frequent participant in discussions of emerging technologies I wish to apply a mild corrective. My aim is not to cast doubt on the merits of quantum computing but to place it in context, and perhaps create a little more space for discussion of other important technologies. Here is the @profserious assessment.

What & Why

The starting point is, necessarily, the science. Quantum mechanics is amongst the most successful scientific theories developed. It underpins semiconductors, lasers, magnetic resonance imaging and much of electronics. The challenge in quantum computing is not the physics, it is rather whether we can engineer devices capable of exploiting quantum effects at useful scale. This turns out to be a hard problem.

A conventional computer stores information in bits that take values of either 0 or 1. A quantum computer uses quantum bits, or qubits. Unlike ‘classical’ bits, qubits can exist in combinations of states and can be linked through the phenomenon known as entanglement. Groups of qubits can therefore represent and manipulate information in ways not available to classical systems.

Qubits behave less like switches and more like waves. As waves can reinforce or cancel one another, quantum states can interfere constructively or destructively. A quantum algorithm is a sequence of operations designed to shape patterns of interference. The objective is to amplify the probability of correct answers and suppress the probability of incorrect ones. When the system is measured, the desired solution is thus the one more likely to be observed. You are not required to understand this in order to understand the potential, or otherwise, of quantum computing.

What -is- important to understand is that these properties do not make quantum computers universally faster than conventional machines. For most computational tasks they are not. The interest arises because there appear to be specific classes of problem where quantum approaches may provide advantages. The most important candidates are optimisation, simulation of physical systems, cryptanalysis and -perhaps - some forms of machine learning. The crucial uncertainty is how large the space of economically important problems that admit substantial quantum advantage ultimately proves to be. This is an extremely challenging technical question in its own right and, arguably, the most important in the field.

We know some useful quantum algorithms exist, what we do not know is whether quantum advantage applies to a narrow collection of specialised problems or to a much broader range of economically significant activities. Advocates often assume many important algorithms remain to be discovered … and perhaps they do … it would be good to have some formal assurance. As the matter stands, it is possible that quantum advantage proves to be powerful but limited in scope.

You may have encountered the term ‘quantum supremacy’ (some researchers prefer ‘quantum advantage’). This is the point at which a quantum computer can perform a specific computational task beyond the practical reach of classical computers. Google’s widely publicised 2019 Sycamore experiment is generally considered the first credible demonstration of this milestone, although the precise comparison with classical approaches remains controversial. Specifically, IBM has rebutted the claim and the Sycamore-specific task has effectively been overtaken by classical methods, though Google has now published results showing that Willow has re-extended the lead. The important point to hold in mind is that supremacy is not the same as utility. Demonstrating that a quantum computer can outperform a classical computer on some specialised benchmark does not mean it can solve useful problems.

We will return to this, but we should first consider the engineering challenges in building a quantum computer.

Engineering Challenges

The primary obstacle is fragility. Quantum states are extraordinarily sensitive to disturbance. Heat, electromagnetic interference, manufacturing imperfections, cosmic rays and countless other environmental effects introduce errors into calculations. Whilst current quantum computers have error rates measured in 10ths or 100ths of a % per operation, useful computation may require millions or billions of operations; error correction is thus the defining challenge for the field. It is discussed further below.

Very large numbers of qubits must work together reliably and a useful quantum computer may require 100s of 1000s or even millions of physical qubits operating in concert, each of which must be manipulated with precision whilst remaining sufficiently isolated from its environment to preserve its delicate quantum state. Every qubit requires control systems, calibration, measurement and error management and small imperfections accumulate rapidly with consequences for scaling.

The environmental requirements are daunting. Superconducting quantum computers operate at temperatures measured in millikelvin (near absolute zero and colder than interstellar space) requiring elaborate cryogenic systems. Trapped-ion machines depend upon extremely stable electromagnetic fields and precision laser control. Neutral-atom approaches require arrays of atoms held and manipulated by sophisticated optical systems. Each architecture faces its own challenges of scaling, manufacturing, reliability and cost. Building a useful quantum computer thus involves far more than producing additional qubits. It requires constructing an entire system in which control electronics, software, error correction, networking, cooling and fabrication all function together within exceptionally narrow tolerances.

Until relatively recently, quantum error correction remained a largely theoretical concept. It was known that, in principle, many imperfect physical qubits could be combined into a smaller number of highly reliable logical qubits, but the difficulty was demonstrating that increasing scale in practice reduced overall error rates. In 2024 Google’s 105-qubit Willow processor produced the strongest evidence that this was the case. Error rates fell exponentially as larger error-correcting codes were used, confirming experimentally the prediction. Similar progress has been reported by Quantinuum in trapped-ion systems and by groups working with neutral atoms. Whilst it is important to emphasise that this does not directly yield a useful quantum computer it does, however, present a dimension along which engineering progress can be made.

The larger consequences are of course that a single highly reliable logical qubit may require 100s or even 1000s of physical qubits, depending on underlying error rates and the error-correction scheme employed. A machine capable of tackling commercially significant problems may therefore require millions of physical qubits. This is why announcements of 100-qubit or even 1000-qubit systems should be interpreted with some caution, whilst they represent progress they remain much closer to the beginning of an engineering process than its end.

Uses

The most straightforward way to understand what this means in practice is by way of cryptography. Much of the public attention surrounding quantum computing derives from ‘Shor’s algorithm’. Shor showed that a sufficiently capable quantum computer could factor large integers and solve discrete logarithm problems exponentially faster than known classical methods. Since the established methods of encryption - RSA, Diffie-Hellman and elliptic-curve cryptography - rely upon the practical difficulty of these problems, a sufficiently powerful quantum computer would undermine much of today’s public-key infrastructure. That is, it threatens the technology that underpins secure digital transactions and communications undertaken without first sharing a secret key.

Whilst the mathematics is well established, engineering yet again gets in the way. A widely cited estimate published by Craig Gidney in 2025 suggests that breaking a standard RSA-2048 key would require 897,864 noisy physical qubits running for 4.96 days. This represents, somewhat surprisingly, progress, prior estimates exceeded 20 million qubits. It also illustrates the scale of the challenge. Current advanced machines contain 100s of qubits, not 100s of 1000s. This is a gap of several orders of magnitude suggesting something more than engineering refinement is required.

Predictions vary considerably, but a useful fault-tolerant quantum computer before the early 2030s appears optimistic. A machine capable of threatening current cryptography is more plausibly a problem for the second half of the next decade or beyond.

Cryptography may not be the most important application of quantum computing, though, for reasons discussed below, it may be the most immediately consequential. The larger economic prize lies in optimisation. Many practical decisions involve searching very large spaces of possible solutions. Thus, airlines seek efficient schedules for aircraft and crews, manufacturers optimise production processes, logistics firms plan routes and warehouse operations, energy systems balance generation, storage and demand, financial institutions optimise portfolios subject to multiple constraints, universities build timetables, and so on. These problems are difficult because the number of possible solutions often grows extremely rapidly with problem size.

The so-called ‘travelling salesman problem’ provides the classic illustration. Given a collection of cities, what is the shortest route that visits each city exactly once and returns to the start? For small numbers of cities the answer is straightforward to determine. For large numbers of cities, the number of possible routes grows very quickly, soon exceeding any practical ability to examine them individually. These combinatorial challenges appear throughout science, engineering, planning and resource allocation.

Quantum systems appear naturally suited to exploring such complex spaces. Algorithms such as the Quantum Approximate Optimisation Algorithm, or QAOA, have therefore attracted significant interest. The difficulty is that convincing demonstrations of practical quantum advantage remain elusive. On current hardware, the strongest results generally show quantum methods approaching the point of becoming competitive with leading classical techniques rather than clearly outperforming them. Resource-estimate analysis paints a less optimistic picture: achieving a crossover against state-of-the-art classical heuristics on even small optimisation tasks would require fully fault-tolerant hardware far beyond anything available today, or likely in the mid-term. The possibility remains that future quantum computers will transform optimisation but the current evidence does not, however, justify assuming that outcome.

Simulation of physical systems presents a stronger case. This was Richard Feynman’s original motivation when proposing quantum computation in the early 1980s. Nature itself is quantum mechanical. Molecules, materials, chemical reactions and many fundamental physical processes are therefore inherently difficult to represent using classical computation. Quantum computers may provide a more natural framework for such problems. Potential applications include catalyst design, battery chemistry, advanced materials and aspects of pharmaceutical discovery. You may think this is hardly surprising, of course the question remains: how much quantum hardware will be required to realise these models in practice.

There is certainly no shortage of discussion concerning quantum machine learning, quantum neural networks and quantum-enhanced AI. There are theoretical reasons to believe that quantum methods may assist certain tasks involving optimisation, sampling, probability distributions and high-dimensional mathematics. Yet practical demonstrations remain limited and reviews of the literature continue to find little consistent evidence that quantum machine-learning approaches outperform the best classical techniques on realistically sized problems. This does not mean useful applications may not emerge but, as it stands, quantum machine learning should be regarded as interesting but highly uncertain.

Quantum Threat

For most organisations the immediate practical quantum issue is not in fact computation but cryptography. Migration towards post-quantum cryptography is already under way and this makes sense. The United States finalised its first post-quantum cryptographic standards in 2024. The UK’s National Cyber Security Centre has established a phased migration programme extending to 2035. Importantly, this date is not a prediction of when quantum computers will break encryption. It is an explicit recognition that replacing cryptographic infrastructure across large organisations can take a decade or more.

The practical significance of the threat depends not merely on when a capable quantum computer appears but on how long information retains value. Much commercial information becomes largely worthless within a few years. A good deal of it within minutes. Operational plans, business negotiations and routine communications rarely require protection for decades. Other information is different. Intelligence sources, defence information, diplomatic communications, health records and certain categories of scientific and industrial data may retain value for very long periods. Such information could plausibly be subject to a harvest-now-decrypt-later strategy in which encrypted material is collected today for future decryption. The sensible response is therefore not panic but classification, understanding which information requires long-term protection and prioritising accordingly.

Quantum communications receives considerable attention in this context, particularly quantum key distribution. Intercepting a quantum communication channel necessarily disturbs the quantum state and reveals the presence of an eavesdropper. Whether this addresses an important practical security problem is another matter altogether.

The National Cyber Security Centre (NCSC) has consistently taken a sceptical position which @profserious shares. The reason is straightforward, successful cyber attacks do not generally depend upon intercepting encrypted communications in transit. They exploit vulnerable devices, compromised users, software flaws or poor operational practice. The endpoints are usually far more vulnerable than the communication channel. Replacing an already secure communication link with a quantum-secure link may therefore do little to improve overall security. Security is a systems problem and, for most organisations, post-quantum cryptography is the correct response to the ‘quantum threat’ rather than large-scale deployment of quantum key distribution.

Opportunities

The most interesting quantum technology over the next period is not, I would contend, quantum computing at all. Quantum sensing exploits the same sensitivity that makes quantum computers so difficult to build. A quantum state that is easily disturbed becomes, from another angle, a precise measuring instrument. This opens opportunities in navigation, timing, healthcare, geophysics, infrastructure monitoring, defence and national security.

The United Kingdom is particularly well positioned in this area. Researchers at the Birmingham demonstrated a field-deployable quantum gravity gradiometer capable of detecting buried tunnels and underground infrastructure through very small variations in local gravitational fields. The associated spin-out, Delta g, is attempting to commercialise what is effectively a form of underground mapping. Quantum magnetometers are entering clinical trials for advanced brain imaging. Atomic clocks and inertial sensors offer the prospect of navigation systems less dependent upon vulnerable satellite infrastructure. Unlike quantum computing, these applications do not require millions of error-corrected qubits. A relatively small number of highly controlled quantum systems can produce useful capabilities.

This changes the policy conversation somewhat - quantum sensing is not a distant possibility. It is an area where the UK’s strengths in physics, metrology, instrumentation and photonics align naturally with practical applications. The economic and strategic benefits may arrive much faster and be more ‘sticky’ than those associated with universal fault-tolerant quantum computers.

The UK’s position is strong although the level of international competition is high (see for example my article on China’s 5-year Plan) . The National Quantum Strategy committed £2.5 billion over 10 years. The National Quantum Computing Centre at Harwell opened in 2024. New hubs support research in computing, sensing, networking and navigation technologies. UK universities remain among the world’s strongest contributors to quantum science, and the country attracts a disproportionately large share of global private investment. The challenge is, of course, not scientific excellence, it is rather commercialisation.

The UK has repeatedly demonstrated an ability to generate promising technologies and innovative firms, something we should not underestimate as national capability. It has however been less successful at scaling them into globally competitive businesses. The acquisition of Oxford Ionics by IonQ in 2025 illustrates both the quality of UK innovation and the continuing difficulty of retaining ownership of successful scale-ups. Equally important is the question of demand. New technologies require sophisticated customers willing to experiment, procure and deploy emerging capabilities. The UK possesses strong potential early adopters in pharmaceuticals, financial services and government. Public procurement can play an important role by acting as an anchor customer for emerging technologies and helping firms cross the difficult gap between demonstration and deployment. Long-term success may depend as much on creating demanding domestic users as on funding excellent research.

Conclusions

Several conclusions seem reasonable. In essence quantum technologies are advancing rapidly but the distance to traverse is very large. Advances in error correction increases confidence that large-scale quantum computation may eventually be achievable. Fault-tolerant quantum computers remain plausible but not imminent, and timescales could reasonably extend to a decade or longer.

Migration to post-quantum cryptography is a sensible precaution and should, as a matter of course, be planned into digital infrastructure renewal. Quantum sensing will likely prove economically significant sooner than quantum computing. The UK’s challenge, as always, is less one of scientific and innovative capability than of commercial execution.

Beyond that, there is no certainty. We have no reasoned basis for ascertaining the set of problems that might benefit computationally from quantum advantage. It could prove to be extensive or narrow. Machine learning may, for example, be transformed, marginally improved or largely unaffected. Timelines may accelerate or disappoint, engineering progress is rarely linear. The sensible position is neither enthusiasm nor wholesale scepticism … just do not bet the farm.

TL;DR Academic careers suit a particular kind of person. You need intellectual stamina and tolerance for ambiguity. You should possess the skills and readiness to be part of a complex institution with all that entails. Success will require flexibility and an entrepreneurial edge. If you value the purposes of universities, and are committed to furthering them, it can be a very good career. If not, there are certainly easier ones.

Should you opt for an academic career? Would you recommend a career in academia to an aspiring student? If so, why? And, if not, why not? @profserious considers the issue.

There is an entire genre of writing devoted to the expression of regret at the choice of an academic career. It comprises two sub-genres. The most prominent is ‘tenure regret’. Early-career academics who have failed to secure a tenured position in the US, generally in the arts and humanities, express their regret at the efforts they have devoted to the cause of academic achievement, only to be frustrated. Often the failure is attributed to opaque processes, disciplinary fashions, or personal animus. Further uncertainty and precarious work, the need to move, and the stresses on young families feature heavily. The principal theme is regret at the initial choice to pursue an academic career and worry at the difficulty of finding other employment, equipped only with a well-regarded monograph on Flaubert, and a comprehensive grasp of the critical tools necessary to dissect neocolonial ideologies.

The second sub-genre is ‘life regret’. In the final years of a career, perhaps with an offer of voluntary redundancy on the table, the author expresses disenchantment with the situation of academia: rising workloads, declining esteem, soulless corporatist management (yes, you @profserious), ungrateful students, and decreasing autonomy. In the background you can sense flagging research productivity in an area that has lost its lustre, perhaps even a receding hairline. Academia is not what it was, and their emotional investment appears to have come to little.

If your diet is simply this writing, then you might be justified in thinking that an academic career is a bad idea. I intend to act as something of a counter-balance. Academic careers can be engaging, rewarding and purposeful - that remains my experience - but, of course, they suit some people, and not others.

A first requirement is obvious enough: you should be good at your subject. Academia is one of the few professions in which your core intellectual capacity is fully exposed. An academic who cannot generate novel insight in their area of interest will eventually find that limitation difficult to conceal. Your early experience of research will have given you a sense of your relative capability in this regard. To be clear, this does not mean being a genius. Most successful academics are not geniuses; they are as scarce in academia as in other professions. But, academics are, or at least should be, able to sustain attention on difficult questions for very long periods of time. There are, in life, many more important personal attributes than an aptitude for some rather particular technical tasks associated with an, often narrow, field of study, but in academia it counts.

One must also be capable of working on large, uncertain, trackless problems. Academic research often involves pursuing objectives whose completion point is unclear and whose value cannot be guaranteed in advance. This can be psychologically difficult. Some people are far happier with shorter, more bounded tasks and with immediate feedback.

Closely connected to this is inquisitiveness. The best academics possess a kind of sustained curiosity that survives professionalisation. They continue to ask questions, follow odd intellectual trails, and become fascinated by things beyond their immediate utility. Without this, academic work can become performative rather than alive - the production of papers merely because papers are required.

Successful academics generally combine specialist depth with considerable adaptability. You need a field - something recognisably yours - but universities reward those who can move between areas, methods, audiences and institutional priorities. Entire disciplines rise and fall over the course of a career. Funding landscapes shift. Technologies change teaching. New forms of public engagement emerge. A scholar whose identity depends entirely upon a narrow specialism may eventually - I suspect, will inevitably - find themselves stranded. You need to sustain a portable intellectual identity: expert enough to matter, flexible enough to evolve.

You should note, of course, that universities are not always the best place to pursue a specific subject. In many areas, notably in science and technology, industry can set the pace. This may vary from time to time, and the cutting edge can shift, back and forth, as it has done for example in machine learning.

It is important to like all the parts of the job, not merely the romanticised core of ‘thinking’. Many aspiring academics imagine a life spent reading, writing, and occasionally delivering brilliant seminars to attentive audiences. In reality, academic life involves administration, committee work, pastoral care, grant applications, quality assurance processes, meetings, and … email. Quite a lot of … email. Teaching is not an interruption to the work; for most academics and in most institutions it is the work. If you do not like teaching, or even if you regard it as, in any way, something that you have to tolerate in order to devote yourself to the ‘life of the mind’, do not become an academic. Imparting knowledge and understanding is of the essence. Frankly, you will be devoting a good deal of your time to it, so you had better enjoy it and find it worthwhile.

A liking for students helps enormously. Universities are populated primarily by students, and many academics spend much of their professional lives engaging with people between the ages of 18 and 25. They need not always be the best interlocutors - indeed they frequently are not - but one should find some energy in their curiosity, uncertainty, ambition and occasional transformation. You can derive pleasure from watching students develop intellectually and personally over time.

Universities are organisations with budgets, hierarchies, politics, compliance obligations and strategic anxieties. The academics who thrive are often those who can find at least some satisfaction in the whole ecology of the profession rather than simply enduring large portions of it. An ability to tolerate and navigate complex organisations is equally important. Universities occupy an unusual institutional space: part bureaucracy, part intellectual community, part commercial enterprise, part public body. They contain competing incentives and contradictory values. Decisions are often opaque and progress can be frustratingly slow. The successful academic learns when to resist, when to compromise, when to ignore, and when to strategically participate. Outrage at institutional absurdities is emotionally exhausting, though perhaps understandable.

And universities need leaders as well as scholars. One of academia’s recurring mistakes is to imagine management as an external imposition. Universities are large, complicated institutions and they require competent leadership. Good heads of department, deans and even vice-chancellors matter enormously. The difficulty is not that universities are managed, but that they are sometimes managed badly. Academics who can combine intellectual credibility with organisational competence perform an important public service, even if their colleagues occasionally treat them as collaborators with the occupying forces.

Academics require a tolerance, even a liking for, ambiguity. Academic work is often poorly defined. There are few clear metrics of success, despite seemingly endless attempts to manufacture them. You may spend many years pursuing a line of research only to discover that it leads nowhere interesting. You may produce your best piece of work and watch it garner almost no attention. Conversely, a workshop paper dashed off with the principal aim of travelling to an attractive conference location may unexpectedly define your reputation and your career. If you require certainty, constant validation, or structured progression, academia can become deeply uncomfortable.

Similarly, universities are loosely managed with limited means of performance oversight. You may get a few pointers along the way. You may be fortunate in finding mentors, sponsors and the critical friendship of a tight knit research group or programme team. You may even find a skilled Head of Department but, regrettably, this is not as common as it should be. In short, you will likely need to navigate and ‘make’ your career yourself. This type of ambiguity suits, and indeed benefits, some but not others. Self-motivation is indispensable. Outside of teaching obligations and administrative deadlines, much academic work lacks much by way of external structure. Nobody truly knows whether you spent the afternoon advancing human understanding or browsing property websites. Academia rewards those capable of, and with a preference, for directing themselves over very long timescales without supervision.

There is a strong entrepreneurial dimension to academic life. This does not necessarily mean founding companies, although you can do exactly that (and I strongly recommend it). Rather, it means creating opportunities instead of waiting for them to arrive: building collaborations, identifying emerging areas, attracting funding, designing programmes, shaping public debates, or constructing institutions within institutions. Universities tend to reward initiative.

Nor are academics, particularly the enterprising variety, restricted to the walls of the university in the way they once were. Increasingly, academic careers spill into industry, public policy, consulting, media, schools outreach, and public engagement. Impact, which naturally entails engagement of this kind, is encouraged. Some academics found start-ups. Others advise governments or international organisations. Yet others become public intellectuals, broadcasters, or writers. The academic career can be surprisingly plural if approached imaginatively.

Purpose matters, and academic careers do not make sense if assessed in purely material terms (though, in fact, the financial proposition is not as bad as some suggest). There are easier ways for a smart person to earn money, often much easier. The rewards are more intangible: intellectual freedom, the chance to contribute to knowledge - and hence perhaps address global and societal challenges, the opportunity to shape minds, occasional moments of genuine discovery, and participation in the collective scholarly enterprise. If these things do not matter to you, the trade-offs made for the career may not seem worth it.

It is also worth remembering that universities differ enormously from one another. Some are intensely research-focused, others teaching-oriented, others civic or vocational in mission. Some are entrepreneurial and outward-looking; others remain highly traditional. National systems vary too. A career that would be unhappy in one institution may be deeply fulfilling in another. ‘Academia’ is not a single thing. It is important to understand that the league table position of an institution does not entirely determine its desirability as a place to work; you need to assess where you will be most successful, where you will find your purpose and your people.

Universities themselves are at something of an inflection point. Technological change, geopolitical competition, new models of knowledge production, demographic pressures, artificial intelligence, changing student expectations, and financial instability are reshaping the sector. This creates uncertainty, certainly, but also opportunity. Aspiring academics should not expect stasis. They are entering a system likely to evolve very substantially over the course of their careers and possibly very rapidly in the next immediate period.

Everything I have said so far, assumes roles are readily available. Given the financial constraints on universities in the UK, I know this not to be the case. You will need to be ‘competitive’ and you will have to likely tolerate an extended period of precarious work as a Research Fellow or temporary Visiting Lecturer. This is unfair, and I wish the system were different.

For all the complaints, some justified, some merely performative, academia remains one of the few careers organised around the proposition that thinking carefully about important questions is socially valuable. For the right sort of person, that remains a rather good way to spend a working life. And, quite frankly, if you do not like it, then you can always leave.

TL;DR: Recent results show that AI can identify vulnerabilities across critical systems in practice and at scale. This shifts the constraint in cybersecurity from discovery to remediation, as detection begins to outpace the capacity to fix. Most organisations are not yet structured for the consequences, nor for the speed at which this capability is diffusing.

There is something both profoundly exciting and deeply unsettling in seeing so much of what I have spent a professional career researching and practising upended. AI, and specifically the rapid development of Large Language Models (LLMs), has had that effect. Most recently AI agents – which combine a language model with tools, memory and structured reasoning – have started to find vulnerabilities in widely used, well-audited, critical software that decades of automated testing and human review have missed.

A flurry of high-profile announcements associated with the limited release of Anthropic’s Claude Mythos Preview has excited attention and concern, at times bordering on panic. The question is how much to make of this. Marketing-induced urgency is not a reliable guide to underlying capability, and moments of heightened attention are best treated as prompts for analysis.

@profserious attempts to provide a balanced assessment of the situation for the broader reader and, for those in technical and policy leadership roles, to point to some steps that might reasonably be taken in response to recent developments. There is a useful rule of thumb when evaluating claims about AI and security: if it comes from a vendor, halve it; if it comes from government, double it; if it comes from an academic paper using a synthetic benchmark, hold it pending real-world results. We are increasingly at the point when those real-world results are arriving and thus we can form a grounded view. So, what has actually happened in the last approximately 18 months?

What Has Changed

Google’s Project Zero team, working with DeepMind, built a system called Big Sleep. In November 2024 it found an exploitable memory corruption bug in SQLite – a database engine embedded in a vast number of devices and so thoroughly tested that new bugs in it are surprising. By July 2025 it had identified a further vulnerability in the same codebase. A startup called AISLE went further. Using frontier models with their own analysis scaffolding, it found 12 zero-day vulnerabilities in the January 2026 OpenSSL release. OpenSSL is the cryptographic library that secures the majority of encrypted internet traffic. The findings included a critical flaw rated 9.8 out of 10 on the standard severity scale, and bugs traceable to 1990s code that had survived years of continuous automated testing. Across 30+ established projects – Linux kernel, Chromium, Firefox, Apache, OpenVPN, Samba – AISLE has reported around 180 externally-validated CVEs (formally registered, independently verified security flaws) since early 2025. Most of these are now patched.

DARPA (the Defense Advanced Research Projects Agency) ran a competition, the AI Cyber Challenge (AIxCC), the lineal descendant of DARPA’s 2016 Cyber Grand Challenge. The competition concluded at DEF CON (the security conference) in August 2025. In it 7 AI systems worked autonomously across 54 million lines of code, found the majority of the seeded vulnerabilities, patched most of them, and surfaced 18 previously-unknown bugs that were subsequently disclosed to the relevant maintainers. The winning team took home $4 million.

Microsoft’s Security Copilot, applied to bootloader code (the low-level software that initialises a computer prior to the operating system loading) in March 2025, found vulnerabilities across GRUB2 (the bootloader used by most Linux systems), U-Boot and Barebox, including issues that could enable bypass of Secure Boot – the mechanism that prevents unauthorised software from running at startup.

What Matters

Impressive though these demonstrations are, they have important limitations. If you strip away the scaffolding – the tool integrations, the iterative planning loops, the connections to existing static analysis software – then the raw model performance on benchmarks is considerably less impressive. The best models score in the low 20s on standard accuracy measures for real-world C/C++ vulnerability detection without that scaffolding.

What is determinative here is system design or the architecture rather than model capability per se. Achieving these outcomes is thus a function of engineering investment, not exclusive access to frontier models – and such investment is well within the reach of capable adversaries.

The Mythos Moment

So, to the most publicised event. On 7 April Anthropic announced Claude Mythos Preview and a defensive consortium called Project Glasswing, with launch partners including Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks. The announcement claimed that Mythos had autonomously identified thousands of zero-day vulnerabilities across critical software infrastructure, found a 27-year-old OpenBSD bug, and chained four vulnerabilities together into a working browser exploit that escaped multiple security boundaries – the kind of multi-stage attack that would typically require a skilled and experienced human team.

The UK AI Security Institute (AISI) – a government body established to evaluate frontier AI systems before and after deployment and now with a growing reputation for independence and technical capability – evaluated Mythos Preview and confirmed it can complete a multi-step corporate network attack simulation end-to-end (in 3 out of 10 attempts), against a scenario estimated to take a skilled human professional around 20 hours.

The achievement should however be placed in context. A research group has taken the specific vulnerabilities that Anthropic showcased, isolated the relevant code sections, and ran them through 8 cheaper ‘open-weight’ models (models whose weights are publicly released and can be run on commodity hardware), including a very small cheap-to-run model. All 8 found the flagship vulnerability. A slightly larger model recovered the OpenBSD bug analysis. This suggests that detection – establishing that a bug exists and characterising it – is now accessible across models of very different sizes and costs. Reliable autonomous exploitation of hardened production systems is, of course, an entirely different capability.

There is a further problem that the widely hyped announcement did not address. Anthropic acknowledges that fewer than 1% of the vulnerabilities Mythos found have been patched. Discovering vulnerabilities at scale without remediating them at comparable scale produces a growing list of exposures, not improved security. The bottleneck in the security pipeline has shifted from finding vulnerabilities to fixing them.

In February 2026 OpenAI published the ‘system card’ that describes the real-world behaviour, limitations and risks associated with its latest model GPT-5.3-Codex. It classified its cybersecurity capability as ‘High’ under its internal Preparedness Framework – the first time any OpenAI model has crossed that threshold. The Framework defines ‘High’ as capable of removing existing bottlenecks to scaling cyber operations, either by automating end-to-end attacks against reasonably hardened targets or by automating the discovery and exploitation of relevant vulnerabilities.

The AISI independently found GPT-5.5 to be the second model – after Mythos Preview – capable of completing its corporate-network attack simulation end-to-end. AISI’s red team also identified a jailbreak (a technique for bypassing a model’s safety restrictions) that worked across all malicious-cyber queries in GPT-5.5, taking 6 hours to develop. A reminder that capability restrictions enforced through model behaviour rather than architectural constraints are not necessarily permanent barriers.

Offensive Capability

So we can reasonably conclude that AI can lower the barrier for attackers ... though this has narrower implications than might at first be assumed.

Academic research from the University of Illinois at Urbana-Champaign in 2024 showed GPT-4 agents autonomously exploiting the majority of known one-day vulnerabilities (flaws with published descriptions but not yet widely patched) when given the vulnerability description, and some zero-days in open-source web applications without prior knowledge.

In August 2025 Anthropic documented a single criminal operator using Claude to extort 17 organisations across government, healthcare and emergency services, with the AI handling reconnaissance, credential harvesting, network penetration and drafting extortion notes demanding up to $500,000 in cryptocurrency. The operator could not have mounted this campaign without AI assistance. This illustrates the barrier-lowering effect: a mid-tier criminal possessing limited technical skills executing a campaign that would previously have required a capable team.

In November 2025 Anthropic disclosed it had disrupted what it describes as the first largely-autonomous AI-orchestrated espionage campaign, attributed to a Chinese state-sponsored group. The campaign targeted around 30 organisations across technology, finance, chemical manufacturing and government, with AI executing the large majority of operational tasks and human operators intervening at only a small number of decision points.

The limitations exposed here are interesting, and help us to assess the overall threat. The attackers gained access to Claude by claiming to be a defensive security firm. Claude hallucinated credentials and misidentified public information as proprietary. Hallucination is a significant obstacle to fully autonomous attacks. AI-assisted attacks introduce characteristic detection signatures: rapid-fire reconnaissance patterns that differ from human browsing behaviour, stylistically uniform code that lacks the idiosyncratic markers of individual programmers, and hallucinated credential artefacts that can be identified in logs. Defenders are able to treat these as indicators of compromise in the same way they treat malware signatures.

Defensive Use

Switching from attack to defence. The enterprise security tooling market is maturing quickly. The approaches that work today are not autonomous threat-hunting in untrusted production but rather analyst augmentation in trusted environments.

Microsoft Security Copilot is now bundled with Microsoft 365 E5, covering alert triage (the process of sorting and prioritising the large volume of security alerts that a typical enterprise SOC receives), access policy optimisation and data security investigations. Microsoft’s trials report a 23% reduction in alerts per incident and faster resolution of policy conflicts.

XBOW, an autonomous penetration testing system reached the top of HackerOne’s global leaderboard in 2025. HackerOne is the largest platform connecting security researchers with organisations running bug bounty programmes. XBOW submitted over a thousand vulnerability reports, of which a significant fraction were verified and resolved. It raised $120 million in March 2026.

Multiple research studies from 2025 report substantial reductions in false positives – in some cases exceeding 90% – when LLMs are used as a contextual triage layer over traditional static analysis tools (software that analyses code without running it, looking for known vulnerability patterns).

The practitioner consensus from the established security conferences, Black Hat Europe 2025 and RSA 2026, is that defenders continue to hold a structural advantage: they own the systems being defended, can run AI inside trusted boundaries and can integrate it with existing security infrastructure. Attackers meanwhile face safety restrictions, hallucinations and detection signatures from high-volume model behaviour.

What To Do

Given all the above, you will want to know what can be done. I will start with enterprises and follow with policy considerations.

The first priority is knowing where AI is already operating in your environment. Shadow AI – models accessed through personal accounts, embedded in third-party SaaS tools without explicit procurement, used by developers outside any oversight process – is an exposure that requires no exotic threat model. An organisation cannot defend a perimeter it has not drawn, and most organisations have not drawn one around their AI usage.

The second is piloting LLM-augmented defensive workflows. Alert triage in your SIEM (Security Information and Event Management system – the platform that aggregates and analyses security logs), false-positive filtering on your most critical codebases, and AI-assisted fuzz (software that bombards a program with random or malformed inputs to provoke crashes) target generation for C and C++ codebases all have established evidence of yielding productivity gains.

If you maintain critical open-source dependencies, the patching pipeline needs to accelerate. The discovery capability that found 12 OpenSSL vulnerabilities in a single January 2026 release is accessible to researchers, criminal operators and state actors simultaneously. CVE volume will increase faster than remediation capacity in most organisations, and the organisations that pre-positioned their patching infrastructure will manage that wave significantly better than those that did not.

Extend your threat monitoring to include AI-specific behavioural signatures alongside traditional malware indicators. Anthropic, Google Threat Intelligence and CrowdStrike all now publish indicators specific to AI-assisted operations. Incident response playbooks also need refreshing: AI-assisted campaigns run at higher operational tempo than human-paced intrusions, with more simultaneous activity across more targets, and playbooks designed for the older pattern will be too slow.

Track the AISI evaluations and OpenAI Preparedness Framework classifications and treat vendor announcements as unverified until corroborated by one of those two sources.

From a policy standpoint, AISI is doing valuable work – its independent evaluations of Mythos Preview and GPT-5.5 are exactly the authoritative evidence that good policy requires, and the model of pre-deployment testing with public disclosure is worth extending and resourcing. The US Preparedness Framework approach, where labs classify their own models against defined capability thresholds and apply corresponding safeguards, is a workable interim mechanism, though it depends entirely on the good faith of the labs doing the classifying. Neither instrument addresses the core problem: capabilities that are frontier today become a commodity within 18 months, and no access control regime is likely to survive that transition intact.

What is actually needed is a shift in where policy effort is concentrated. The current debate centres on restricting access to the most capable models, which is a reasonable precaution but a losing strategy over any time horizon longer than a product cycle. The more durable intervention is on the defensive side: mandating minimum patching timelines for critical infrastructure operators when AI-assisted discovery produces a CVE wave, funding open-source security tooling at a scale commensurate with the problem, and building the kind of national vulnerability remediation capacity that matches the discovery capability now becoming available. The UK’s £90 million announced at CYBERUK 2026 is directed primarily at SME ‘cyber hygiene’ over 3 years and is welcome ... as far as it goes. The Cyber Security and Resilience Bill, currently progressing through Parliament toward Royal Assent later this year, updates the 2018 regulatory framework and extends obligations to managed service providers for the first time. Both are steps in the right direction. Neither addresses the core problem, which is that AI-assisted vulnerability discovery is now operating at a scale and speed that existing patching infrastructure, regulatory timelines and funding envelopes are not adapted to handle.

AI security tooling has moved from research demonstration to production relevance on both sides of the fence. Defensive applications – alert triage, vulnerability discovery, false-positive filtering, autonomous penetration testing – are delivering clear improvements against prior baselines. Offensive capabilities have lowered the barrier for mid-tier criminal actors and enabled more scalable intrusion campaigns.

Where This Leaves Us

The variable most organisations are neglecting is the speed at which these capabilities propagate. Capabilities at the frontier today tend to diffuse into open-weight models within 12 to 18 months, at a fraction of the cost, and with far broader accessibility. The gap between attacker access to capable AI and defender integration of capable AI is, in most enterprises, widening. The tools to close it are already commercially available, but the issue is adoption.

We can now find vulnerabilities at scale; the question is whether we can adapt systems, processes and capacity to fix them at comparable speed.

I am asked, as a member of the Jewish community, to undertake ‘security duty’ outside synagogues, schools, and centres of communal activity.

My draft is here and I must go.
Bound to duty as I am.
A watchman. Sentry. Guard.
Not on some distant frontier,
Nor on the walls of the city,
such as they are.
But here, close to my home.

By the Kosher butcher.
Where my son went to nursery.
Opposite the minicab office.
Where there are flags,
that fly from lampposts.
Secured by yellow cable ties.
Proclaiming what ... I cannot say.

My uniform is not martial.
It signals no authority, no rank or distinction.
And I bear it without pride.
My armour, a stab-vest and tabard,
is a size too small and barely fits,
over my coat. It may get cold,
my wife says, by way of a farewell.

The radio is a distant connection.
Zulu-One, is on the corner.
There is a man in an Uber.
And a street-drinker.
And a resident annoyed about the parking.
Or I could stand beneath the tree,
out of the rain.

Zulu-Three is Marsha.
My son went to school with her daughter.
She was scary,
apparently.
Her stab-vest is too large.
She is not happy about the rain.
Or the resident.

Spit, paint, piss. Fire, knife, gun.
Word and deed.
The punishment for a collective sin.
For the will to survive. For the desire for safety.
And this duty is a last protection.
The watch is long. My back hurts.
And my wife was right about the coat.

TL;DR: Bureaucracy in public institutions is not principally a management pathology. It is the cumulative result of a largely logical process. It is generated by policy and rendered permanent by asymmetric incentives. Nobody decides to create it; nobody is readily positioned to undo it.

We are, in public institutions, hemmed in by a rising tide of bureaucracy that stands between us and the achievement of our missions. It absorbs resource and diverts attention. It damages professional autonomy. This bureaucracy is often attributed, depending on your worldview, either to the impositions of ‘managerialism’ or to an inclination towards ‘liberal correctness’. Both diagnoses mistake symptoms for causes. What we are seeing instead is the autonomous operation of what I will call the bureaucratic escalator.

The bureaucratic escalator is the cumulative translation of policy intent into regulatory condition, compliance machinery and institutional assurance structures, driven forward by asymmetric incentives, and embedding obligations that are progressively harder to unwind. @profserious examines how the escalator works in order to understand how its worst consequences might be mitigated.

I have set out in Something Must be Done how often narrow, albeit worthy, concerns manifest as policy. And then how public institutions are assigned responsibility for realising these policies. It is important to understand that the first step onto the bureaucratic escalator proceeds from a genuine intent to do ‘something’ about a manifest issue. Once stepped onto, however, the escalator progresses regardless of the intentions of those travelling on it.

There is an obvious problem that, if I identify some of these issues now, it will distract from my primary purpose. It will appear as if this article is actually about, in the case of higher education, and as an example, the importance of visa compliance, fit-and-proper persons requirements, prevention of harassment and sexual misconduct, or whatever, and it categorically is not. This is about how bureaucracy arises and takes hold, not through obvious ill intent but through a largely logical and cumulative progression.

So I will call our starting point simply ‘that-issue’ and assume ‘that-issue’ has been subject to a political or policy process yielding a ‘direction’. In the case of a regulated public institution this direction must now be realised as a regulatory condition or provision. It may be accompanied by politically demonstrative penalties for non-compliance. Let us follow the process.

First, specify the condition. The condition must be precise enough to be enforceable, broad enough to cover the range of institutional circumstances, durable enough to survive legal challenge, and sharp enough to answer the political imperative. These requirements pull against each other and thus the drafting process itself generates complexity.

Next, run the consultation. A consultation must be suitably configured and resourced. Individual institutions will need to respond, engaging with each of their stakeholders, internal and external. Groups of institutions and other representative bodies will also need to respond, consulting in turn with their members so as to establish a collective position.

Then respond to the consultation. Even in the common circumstance that the consultation is largely a formality, the regulator must give some account of how the results have been accommodated. This account itself becomes guidance which must be read, interpreted and acted upon.

Build the compliance architecture. The monitoring regime, the escalation procedures, the appeals process, each is a substantial piece of work, independent of the underlying condition. The regulator must design and resource all of it. Institutions must understand and respond to all of it.

Publish and stand behind it. The condition, the guidance, the compliance framework and the penalties must all be made public, in a form that is legally coherent and ideally intelligible. Subsequent investigations, findings and interventions become part of the story, each adding interpretive weight to what the condition means in practice.

Now the regulatory subject must:

Communicate it internally. Not simply circulate a document, but ensure that the right people understand what is now required of them and why. In a complex institution this means identifying who is affected, which is itself non-trivial. A condition touching on, for example, staff-student relationships implicates HR, legal, academic line management, student services, students’ union, and the governing body simultaneously, each of whom will read the same condition differently. Ultimately, of course, all staff and students will need to receive communication that is appropriate to their role.

Set up a policy. Which must be drafted, reviewed by legal counsel, consulted upon internally, approved through governance, published, and version-controlled. The policy must be consistent with existing policies, which may themselves then require revision. Policies have owners, review cycles, and amendment histories.

Set up a process. Which translates the policy into operational reality, establishing who does what, in what order, by when, and with what authority. The process must be documented, tested, and made accessible to those who will operate it. It will interact with other processes, some of which will inevitably need to be modified to accommodate it.

Train the individuals involved. Which means identifying who needs what level of understanding, designing or commissioning appropriate training, delivering it, recording completion, and handling those who have not completed it. Where the condition requires training from those with ‘demonstrable experience’, the institution must either verify that its existing providers qualify or procure new ones, with all that entails.

Resource the function. Which means deciding whether existing staff can absorb the new responsibility, or whether new capacity is required. In practice, the answer is usually the former at the outset but the latter thereafter, as the true scale of the ongoing commitment becomes apparent. At that point, of course, the agenda has moved on and ‘that-issue’ no longer has currency. Nevertheless, the resourcing commitment remains.

Map accountabilities. Which means determining who is responsible for what, and ensuring those responsibilities are formally recorded. In a governed institution this means committee terms of reference, job descriptions, and delegation frameworks may all need amendment. Where the condition attaches personal responsibility to named individuals, as for instance fit-and-proper requirements now do, the mapping must be precise and defensible.

Monitor compliance. On a continuous basis, not merely at the point of implementation. Monitoring requires data, and data requires systems. Where the condition involves staff conduct, student experience or third-party relationships, the monitoring infrastructure may be substantial. The regulator will likely ask for evidence and probably impose their own reporting obligations, with associated data standards that will need to be adopted.

Handle non-compliance. When it arises, through a process that is fair, documented and, again, defensible. Non-compliance may involve students, staff or third parties. Each requires different handling. The process must sit within the institution’s broader disciplinary and grievance frameworks without creating inconsistency or legal exposure.

Quality assure the process. Periodically verifying that what is supposed to happen is actually happening. This is distinct from monitoring compliance with the underlying condition; it is compliance with the compliance process. Audit committees, internal audit functions and external reviewers will all have a stake.

Report for governance. Producing regular assurance to the governing body that the institution is meeting its obligations. Governing bodies are themselves now under greater regulatory scrutiny and will certainly ask questions. The report must be accurate, timely and pitched at the right level of abstraction. Someone must write it and, of course, someone more senior must sign it off.

Revise the process as guidance evolves. Because regulatory guidance is not static, the regulator will inevitably publish clarifications, update guidance, issue sector-level findings from investigations and amend the condition itself. Each revision requires the institution to assess whether its policy, process, training and monitoring remain adequate.

Each of these steps follows from the other and each requires time and effort. Each requires management attention. Each generates forms and processes. Above all each renders collateral process more complex and intertwined, raising the bar for further assurance. The cost this imposes is real but invisible in any account of what the original policy intervention was expected to cost.

An escalator differs from a simple ‘point’ imposition because, once you are on it, it carries you forward regardless of your best intentions and you cannot easily get off or, to stretch the metaphor, walk down the up-escalator. Each of these institutional steps embeds the bureaucracy. The policy exists, and to remove it requires a decision. The process is in place, and to dismantle or disentangle it requires effort and justification. The roles and resources are allocated. The governance report becomes part of the assurance structure. No individual actor made the decision that this was worthwhile, and no individual actor can unwind it. The regulator has no incentive to retire a condition that is being complied with. Compliance is after all, and certainly from their perspective, success. The institution has no incentive to argue for its removal. Doing so signals indifference to ‘that-issue’, which carries its own reputational risk. The escalator moves in one direction.

Whilst there is no mechanism by which the accumulated weight of regulatory compliance can be simply reversed, its worst consequences can be somewhat mitigated by institutions that are willing to act deliberately rather than reactively. Some options follow:

Calibrate your risk appetite. No institution can, or should, aim for identical levels of compliance effort across every condition. The governing body should make explicit, and own, a view about where full and demonstrable compliance is essential, where adequate compliance suffices, and where the institution is willing to be a late adopter and accept the consequences (though disproportionate penalties may skew decision making).

Implement lightly. Learn what the condition actually requires in practice rather than what it appears to require on paper, and build the durable infrastructure only once the shape of the obligation is clear. Regulators tend to be more tolerant of good-faith iterative compliance than institutions assume. The cost of excessive effort at the outset to comply to a specification that turns out to be wrong is rarely counted but is often substantial.

Engage on proportionality. Most regulatory frameworks contain proportionality provisions that institutions rarely invoke explicitly. Make the case for a proportionate implementation, and document that engagement. Pursue collective action through representative bodies where possible.

Impose internal sunset discipline. Regulators will not ask whether a compliance process is still necessary. Every compliance process should be subject to regular review where the question is not ‘is this still operable’ but ‘what would we lose if we stopped’.

Frame correctly. Treat regulatory compliance as a managed obligation, calibrated to risk and proportionate to circumstance. Institutions that can do this consistently, and thereby avoid the inclination to gold plate, tend to implement more efficiently and maintain cleaner compliance functions.

There is, of course, one further mitigation: avoid setting the escalator in motion in the first place. Resist the initial policy imposition by engaging in the political process before the direction is set. Make the case upstream rather than managing the consequences downstream. This carries reputational risk because indifference to ‘that-issue’ is not a comfortable position. It is nevertheless the most effective intervention available, because every subsequent mitigation is damage limitation.

A final word to those who experience all of this as managerial imposition and direct their frustration accordingly. Much of what lands on desks as bureaucracy originated in a political process, passed through a regulatory process, and arrived in the institution because that is where the law and the regulator have placed it. The managers implementing it are, more often than not, doing what they are required to do. If there is a complaint to be made, it properly lies in the domain of politics and regulation rather than with colleagues tasked with implementation.

TL; DR: Mindfulness promises stillness; academic life supplies email. Calm turns out to be contested.

Like many people, I am occasionally advised to try mindful meditation before sleep. It is said to be particularly helpful for those whose work involves sustained thinking, and universities are full of such people. I am not certain that I am amongst them, but it seems reasonable nevertheless to at least give it a try. So I find myself listening to a guided meditation on my headphones. A calm female voice, with what I suspect to be a Californian accent, begins. Thoughts come unbidden.

Find a comfortable position.

... This is already more difficult than expected.

... I am probably going to have to put my laptop down.

Gently allow the day to fall away.

... The day does not fall away.

... It, and the long list of unanswered emails, remain stubbornly present.

... In particular, that reminder of an overdue review.

Notice your breathing.

... I notice my breathing.

... It appears to be getting more rapid. I am thinking of my diary.

Allow the body to soften.

... My body softens.

... It was pretty soft to start with. This job will kill me.

Let your attention move slowly down through the body. We begin with the feet.

... My feet are heavy.

... They might reasonably be used to kick that student who has still not started their project.

... The thought is unworthy. I recall again the overdue review.

Let the shoulders drop.

... My shoulders drop.

... They are no longer carrying that unread thesis, an iPad and two laptops back and forth on the tube.

If thoughts arise, simply acknowledge them and allow them to pass.

... A thought arises.

... It concerns the email that began ‘just a quick question’.

... I acknowledge the thought.

... I contemplate reply-all.

... I further contemplate a targeted assassination.

Allow the mind to become spacious.

... My mind is spacious.

... In particular, there is a space where the methodology section of that paper should be.

Notice the calm behind the thoughts.

... Behind the thoughts there is calm.

... But between me and the calm is the Head of Department.

You are safe here.

... I am indeed safe here.

... Unless that student has, in fact, just submitted a 4,000-word draft at 23:58.

Simply observe whatever arises.

... What arises is the phrase ‘impact case study’.

Let the future take care of itself.

... Why did I agree to give that seminar on Wednesday?

There is nowhere you need to go.

... There is nowhere I need to go.

... Except Keele, for the seminar on Wednesday.

Just rest in awareness.

... I rest in awareness.

... Just like I rested in that curriculum review meeting. I did not snore.

Now gently return your attention to the present moment.

... I return my attention to the present moment.

... The present moment contains the same long list of unanswered emails.

TL;DR: The Defence Industrial Strategy is one of the clearest recent statements of UK technology industrial policy, even if it presents as a defence document. It creates a new innovation architecture and identifies the frontier sectors expected to carry both military capability and economic advantage. Until however, the Defence Investment Plan settles the funding, it remains an ambitious framework whose credibility depends on whether the money follows.

Some time ago, I was sitting in the pillared hall of ‘Main Building’, the Whitehall home of the Ministry of Defence (MoD). I was drinking a cup of, at best functional, Costa coffee in the company of a former MoD Director-General, discussing matters of strategic import. I expressed, politely, my support for Dominic Cummings’ (then Chief Adviser at Number 10) views on the pace of innovation in technology and how defence could accommodate it. My interlocutor raised an eyebrow. Yes, he said with a wry smile, whenever we have a difficult SpAd (Special Adviser), we simply point them at defence procurement reform; we rarely hear from them again …

That exchange has stayed with me as a telling observation on MoD’s institutional inertia. The UK Defence Industrial Strategy (DIS), published in September 2025, may be different from prior attempts at reform, or it may not. It has regardless the potential to be one of the most significant statements of UK technology industrial policy for some years. The fact that it is framed as a defence document helps to explain why the S&T community has largely missed it.

If you are interested in S&T policy DIS merits, I believe, your attention. Taken together with the Strategic Defence Review (SDR) and the, allegedly, forthcoming Defence Investment Plan (DIP), it forms the clearest recent statement of how the UK intends to link science, industry and national security capability. It also has very current political resonance. @proserious attempts to spare you some effort with this summary analysis.

The DIS is the second major component of the 3-document structure (SDR-DIS-DIP). The SDR, published June 2025, sets out what the UK’s armed forces need to become. The DIS sets out how the country intends to build and grow the industrial and technological capability to deliver it. More on the DIP later.

The framing of the DIS is anchored in the realities of, and lessons from, current conflicts and ongoing geopolitical contest. The war in Ukraine has demonstrated that the pace of military-technological innovation has shifted fundamentally, measured now in days and weeks rather than months and years. Whoever gets technology to the frontline fastest wins. The procurement culture hitherto, in which a decade between requirement and delivery was regarded as unremarkable, is incompatible with that reality.

Ukraine has also taught a hard lesson that sits alongside this innovation observation and further complicates the analysis. Speed of innovation certainly matters, but so does the ability to sustain production at scale under conditions of prolonged attrition. An approach designed around the assumption of short, decisive conflicts, has proved poorly suited to a war of industrial consumption. Shells, missiles and energetics production capacity all fell short of what sustained warfighting required. The DIS commits £6 billion to munitions (in this Parliament), including an ‘always-on’ production pipeline and new energetics factories, but also raises a structural question. A defence industrial base optimised for rapid technology iteration and small-batch production of novel systems is not necessarily one capable of surging to mass output of proven systems when the situation demands it. The requirements pull in different directions, and the strategy is more convincing on the former than the latter.

Prior UK defence strategies have treated the industrial base as a procurement mechanism – a means of equipping the armed forces, evaluated primarily on cost and delivery schedule. The DIS shifts things, at least conceptually. It treats the industrial base as a national strategic asset, simultaneously a security capability, an economic engine and a technology accelerator. Defence spending is in this context repositioned as a strategic demand signal that can shape the technological trajectory of the broader economy as distinct from simply a cost.

This is a key change, and it reflects a wider shift in thinking that has been building globally since the US CHIPS and Science Act set the bar for large-scale state intervention in advanced technology markets.

The most significant structural consequence arising from the DIS is the creation of UK Defence Innovation (UKDI), established during 2025 as the centrepiece of the new innovation architecture with a ringfenced budget of at least £400 million annually, rising in future years. UKDI consolidates what was previously a fragmented, and largely impenetrable, landscape of defence innovation bodies under a single organisation with, supposedly, greater operational freedom from standard MoD procurement processes. It has a dedicated Rapid Innovation Unit explicitly modelled on the US Defence Innovation Unit, and a mandate to fail fast, reallocate funding at pace, and take commercial and capability risks that traditional MoD programmes structurally cannot. The Chief Executive sits on the Defence Growth Board. For a technology firm, a university, or a venture-backed deep tech company seeking to engage with defence, this is a major architectural change to take account of.

From 2026, at least 10% of MoD’s equipment procurement budget is to be spent on novel technologies, defined to include quantum systems, autonomous platforms and AI and related enabling capabilities. This could be important, if honoured in more than letter, and, of course, sustained.

The frontier industries identified in the strategy are likely to be familiar to @profserious followers: quantum technologies, drones and autonomous systems, space, AI, cyber, engineering biology, advanced connectivity and semiconductors. The DIS commits to treating these as industrial development priorities, with dedicated demand signals, regional cluster support, access to test and evaluation infrastructure, and systematic connections to the university base.

On AI specifically, the DIS creates a protected Defence AI Investment Fund, separated from UKDI’s general budget, to accelerate adoption across the MoD. The Defence AI Centre leads this work in coordination with DSIT’s Sovereign AI Unit. The DIS is explicit that ‘transformative AI’ presents risks and opportunities relevant to the broader national security agenda over and above simply procurement. There is a commitment to spend £4 billion on uncrewed and autonomous systems (over this Parliament), with £180 million already announced for AI-enabled digital decision capabilities, giving some substance to the analysis. A critical question the DIS does not answer is how MoD will develop and retain the expertise to be an intelligent customer for AI-enabled systems, a challenge that has defeated more capable organisations than MoD.

Test and evaluation (T&E) is often treated as a side-issue, but is given due attention in the DIS. The strategy commits to a reformed approach with an online T&E marketplace, mobile test technologies to reduce barriers for SMEs, a high-fidelity virtual test range, and a ‘Range of the Future’ programme at Dstl. There is specific acknowledgement that MoD is exploring secure supercomputer capability and connectivity to support testing, recognising a long-standing infrastructure gap.

‘Dual-use’ is handled with more sophistication than previous strategies (though still not wholly satisfactorily). The DIS does not treat military and civilian technology development as separate pipelines with occasional cross-pollination. It treats them as structurally interdependent – defence investment drives civilian innovation, civilian scale-up generates battlefield advantage – and proposes institutional machinery to exploit that interdependence deliberately, including proposals such as a Civil and Military Industries Forum and closer coordination between MoD, DSIT and UKRI. Whether the machinery works in practice is another question, but the idea is right and strongly to be welcomed.

There is one further area the DIS gestures at, but does not resolve, and it matters greatly to anyone with an interest in how science advice operates in government. Obviously, count me in. Dstl is being repositioned – yet again. It is asked to narrow its focus to issues requiring sovereign scientific ownership while acting as a gateway to the broader academic research base, explicitly partnering with ARIA on what the document calls ‘generation-after-next innovation’. The MoD’s R&D budget is confirmed at over £2 billion for 2026–27, rising annually. That is a big number but sceptics, count me in again, may be doubtful about how it will be spent. The account of the governance over how scientific priorities are set within the new architecture is notably thin. The document states that MoD’s Chief Scientific Adviser (CSA) sets the ‘applied science and technology demand signal’, but says next to nothing about how that role operates in relation to UKDI, the National Armaments Director, and the reformed procurement machinery. In a structure that has deliberately separated innovation from procurement bureaucracy, the question of where science sits is critical. The troubled history of defence science advisory structures, characterised by systematic disempowerment, suggests that when institutional authority is unclear, the voice of science tends to lose out to the voice of acquisition. The DIS may well have simply added to that problem.

An international comparative context is helpful, I believe, to understand the DIS. Each major player is attempting procurement reform, though obviously from a different starting position and with different tools. Nevertheless, there is much to learn.

The US published its first-ever National Defense Industrial Strategy (Implementation Plan here) in January 2024, identifying supply chain resilience, workforce readiness, flexible acquisition and economic deterrence as its four organising priorities. That document was a Biden-era product. The Trump administration has overlaid (or perhaps superseded) it with something more assertive but, arguably, less strategic: an April 2025 Executive Order directing a comprehensive overhaul of defence acquisition processes, with an explicit first preference for commercial solutions, a general preference for so-called ‘Other Transactions Authority’ to bypass standard procurement rules, and a ‘ten-for-one’ deregulation requirement (for every new regulation or rule a federal agency proposes to introduce it must identify ten existing regulations to be repealed) for any new internal guidance. Major defence acquisition programmes more than 15% behind schedule or over cost are subject to review for potential cancellation. The workforce is to be restructured, performance metrics rewritten, and risk-taking formally incentivised. The direction of travel is in some ways similar to the UK’s – speed, commercial preference, procurement reform – but the instrument is an Executive Order rather than a strategy document, the timelines are aggressive, and the ideological framing is deregulation rather than industrial development. Whether this produces faster delivery or simply faster chaos is a question we will all too soon learn the answer to.

Germany’s ‘Zeitenwende-era’ strategy (the term denotes the post-Ukraine changes in the European security order), adopted December 2024, is the most explicitly strategically-driven of the European responses. It acknowledges that Germany’s historically constrained approach to defence industrial policy – shaped by post-war constitutional and cultural inhibitions – is no longer adequate, and commits to building a domestic industrial base capable of sustaining collective defence at scale.

The EU’s European Defence Industrial Strategy, published March 2024, operates at a level above member state strategies. It seeks to turn a growth in member state defence spending into durable demand for a European industrial base, pushing for joint procurement, common standards and reduced fragmentation across what remains a collection of nationally siloed defence markets. The European Defence Industry Programme provides financial instruments to incentivise collaborative procurement. Neither the German nor the EU strategy resolves the fundamental tension between ‘buy European’ ambitions and the reality that much of the best technology continues to come from the United States. That tension is currently acute, given uncertainty over US reliability as a supplier.

Canada, arriving late to this conversation with its own strategy in early 2026, has indicated an ambition to award 70% of federal defence contracts to domestic firms within a decade – an unusually specific commitment that reflects the particular pressures of operating in the shadow of an ally whose security guarantees have become, politely, politically contingent.

Against this allied effort sits China’s Military-Civil Fusion strategy (previously discussed in my review of the 5-year Plan), which is worth understanding as the structural challenge that motivates it. China has not published a standalone defence industrial strategy in the sense set out above, because it does not require one. Military-Civil Fusion – embedded across the party-state apparatus – creates an integrated ecosystem in which civilian technological innovation automatically serves military purposes. The institutional separation between commercial R&D and defence application does not exist. Our challenge is to achieve something functionally similar whilst preserving the commercial and institutional pluralism that is, paradoxically, a genuine source of technological advantage. The DIS is the UK’s attempt at that balance.

None of this is without cost, needless to say. The DIS is a strategy document, and strategy documents are arguments about what should, in principle, happen. Whether it actually happens depends on the third document – the Defence Investment Plan (DIP) – which was promised for autumn 2025, missed that deadline, then missed Christmas, then missed the new year, and is now reported to be targeting June with no guarantee even of that. The delay is understood to be driven largely by HM Treasury’s unwillingness to release funding at the pace the MoD needs, leaving little headroom even to deliver the programme of record before any new investment is considered. The National Armaments Director Group – the new institutional centrepiece of procurement reform – became fully operational on 1 April, but widely circulated reports describe an organisation finding its feet slowly and ‘lots of workshops, little meaningful action’, which seems plausible. Meanwhile, without orders and contracts, the defence industry risks a rapid disenchantment.

The institutional architecture described in the DIS is a reality, UKDI exists. The 10% commitment is on the record. The framework is the right one and the frontier industries it names are, if unimaginative, at least the right ones. But architecture requires foundations. Until the DIP is published and the funding settled, the DIS remains the most interesting unfunded technology strategy currently in Whitehall. That is intended as a narrow compliment.

TL;DR: Very few organisations are innovative as organisations – as opposed to containing innovators. Arizona State University (ASU) is one that is, and has built that capacity deliberately, through sustained vision, structural flexibility, and a willingness to make big bets and to follow them through operationally. 10 lessons follow, each requiring deliberate institutional choices, but demonstrably achievable.

This is about a university but I hope what follows is relevant beyond higher education and applicable to other large and complex organisations.

There is a great deal of innovation in universities, less of late, but nevertheless universities remain a place where you can find imagination and enterprise. There are however, very few innovative universities. By this I mean universities that are capable of systematically harnessing the imagination and enterprise across the full range of their mission, directing it to a collective purpose and organising to secure the benefits at institutional scale. And, being able to do so repeatedly, thus able to rely on that capacity. An organisation that contains innovators is not the same as an innovative organisation.

Arizona State University (ASU) is one of the very few that has good claim to be an innovative university in this sense. ASU has been ranked No. 1 in the ‘Most Innovative Schools’ category by US News & World Report for 11 consecutive years. Whilst this ranking is achieved through a peer reputation survey, with all the risks of being self-reinforcing, it nonetheless reflects substantial strategic achievement and has provided the basis for significant improvements in overall performance – including against metrics that ASU might not, in principle, choose to measure itself by. It is a highly successful organisation.

I have taken a close interest in ASU, and made two recent visits. I have sought to understand what it has done, and most particularly how it has innovated. There are many features of ASU that other institutions cannot readily replicate, most notably its location in a region experiencing extraordinary tech-led growth and sustained population expansion. There are some features – perhaps – that one would not choose to reproduce, but every institution is different. US universities are less hemmed in than others by regulatory constraints, though fairly obviously they have their own policy tribulations of late.

Two structural advantages deserve acknowledgement before we move to the lessons. ASU has enjoyed inspired, but also long-standing, leadership from its President, Michael Crow, whose tenure itself forms part of the enabling infrastructure for innovation. The sustained vision that arises from this has provided the stable direction that supports innovation with confidence. Institutions in constant strategic flux, somewhat ironically, may find it more difficult to form the basis for collective innovation. Frequent leadership change can be inimical to institutional learning.

ASU also has some of the financial weight that allows it to do things out of the reach of many institutions – but it achieved this not because of a reputational legacy, but because of being an early mover in online education. Thus it is capable of being innovative because it has been innovative. Early strategic bets, made at scale and followed through operationally, compound over time. This compounding effect of early bets made well is under-appreciated.

Here are 10 key lessons. I wish to stress that these are my interpretation of what I have seen. I am not absolutely sure that ASU would recognise all of these, at least in this form. They are lessons about organisational operating model rather than about particular initiatives.

1. Vision as Infrastructure: ASU is building the ‘New American University’ – an institution that places primacy on inclusion and public value, but boldly asserts that this is consistent with research and educational excellence. This remains a critical distinguishing mark of the institution. What is particularly important, however, is the ubiquity and embedded nature of this vision. It appears on walls, plaques and stone markers throughout the campuses. Faculty and staff understand their purpose with respect to it, and champion it. The lesson is not to have a vision, it is rather to make the vision inescapable.

2. Ambition to Scale: ASU sets its scale ambitions very high. Initiatives are expected to be bold and to establish stretch targets. If an initiative does not aspire to be nationally significant, to impact thousands of students, and to yield very substantial income, it will likely not meet the institution’s goals. Scale is simply treated as a design expectation. ‘Go big or go home’ is very much the tenor of the approach – but without, I sense, grandiosity.

3. Making Big Bets: ASU maintains a portfolio approach to innovation but is ready to back its judgement. Having determined that an initiative has the potential to scale – albeit with significant risk – it will follow through with investment at a level required to secure rapid progress and delivery. These are not half-hearted experiments. They are intended, and expected, to build sustainable differentiating capabilities. A portfolio composed only of low-risk bets is not in fact a portfolio strategy.

4. Openness to Partnership: ASU partners readily and with low ego. Particularly notable is the breadth of its partnerships – commercial corporations, state and civic organisations, civil society groups, investors and developers. The range of mechanisms and models it deploys is striking. It looks for wins, scale, and innovation leverage from wherever they are obtainable. The question it asks is not ‘is this the usual kind of partner?’ but ‘does this materially advance the mission?’

5. Structure for Flexibility: A large institution with strong visionary leadership at its apex might not always succeed at innovation beyond the direct ambit of that leadership. ASU seems to overcome this. It has diversity of thought and distributed leadership engagement, and has built a ‘balanced’ matrix structure with a range of challenge-focused research institutes alongside core colleges and schools, with cross-cutting institution-wide functions embedded within what it calls ‘enterprises’ – all equivalently empowered. Innovation can then emerge from wherever it is best placed to do so.

6. Systems Innovation: ASU seeks integration across all dimensions – liberal and vocational education, K-12 schools, international and transnational provision, large employers, and so on. Part of this is simply enterprise. But part of it is a deliberate attempt to position ASU at the core of a larger integrated educational system, capable of sustaining innovation at the level of the system, not just the institution. Most organisations innovate within their boundaries, ASU innovates by reshaping them.

7. Design as Strategy: ASU brings coherence to what might otherwise be a diffuse innovation agenda by articulating design aspirations rather than strategic principles. The distinction is worth pausing on. A design aspiration directs the innovator towards the choices that need to be made in the process of realisation – it is generative rather than merely directive. It signals an organisation that is design-led, and provides a shared grammar for decision-making.

8. Ensure Alignment: ASU is one of the largest providers of online education in the US. What it achieved that others have not is the integration of online delivery within the full programmatic structure of a research-intensive institution. Degrees are independent of delivery mode; students can mix online and face-to-face according to their own needs. The critical lesson here is not the online capability itself. It is that ASU does not silo learners or innovation. Structural separation of a new activity from the core is a common failure mode, ASU has largely avoided it.

9. Own the Capability: ASU understood that innovation only yields its full benefits if one is prepared to drive the underlying capability to deliver its potential. It built a scaled internal capacity to deliver online programmes and deployed different organisational forms and vehicles for delivery where needed. Innovation without operational capability is a pilot that never delivers at institutional scale.

10. Tolerate Mess: ASU is, by the standards of universities, a well-managed institution. But it has exploited structural and model diversity to accommodate innovation, and not all the structures are neat and tidy. It tolerates overlap, ambiguity and mess where these facilitate innovation. It has little patience for institutional obstruction and will simply skirt it. Tidiness is not a virtue if it is secured at the cost of adaptability or pace.

ASU demonstrates that a large, complex, public institution can be systematically innovative – not occasionally, and not in silos, but as a reliable organisational capacity. It is worth studying carefully. What my observations point to, collectively, is a particular organisational disposition – towards scale, towards openness, towards design, towards the tolerance of productive disorder. That disposition has to be chosen, and then continuously reinforced. That is, of course, the hardest lesson of all – but, perhaps the most readily transferable.

TL;DR China's 15th Five-Year Plan is a technology strategy document disguised as an economic plan. Its core ambition is not simply self-reliance but ‘dependency inversion’ – reducing China's exposures to the West whilst making others dependent on China. A fiscally stressed, but technologically ambitious, Beijing has every incentive to convert its leads into leverage rapidly.

I grew up with a large valve radio salvaged from the loft. At night, curtains drawn, lights off, I would lie in the glow of its illuminated dial – Hilversum, Droitwich, stations long dead even then – and tune to shortwave. Radio Kiev, a sister station to Radio Moscow, offered production statistics delivered with the flat authoritative voice of an official truth. The progress marked against the Soviet 5-Year Plan. After the news came Vladimir Pozner, in flawless American-accented English, to tell us what we had not been allowed to know. And further along the dial, past the static, the numbers stations: punctuated sequences in distant female voices, introduced sometimes by a few bars of the Lincolnshire Poacher.

I had not thought much since then about 5-year plans, until last week when a friend, Charlie Parton, a distinguished China analyst, sent me a paper – ‘The ‘Two Sessions’ and the 15th Five-Year Plan’, and a companion piece ‘China’s National People’s Congress 2026, Five-Year Plan, and the economy: guidelines and faultlines’ by George Magnus. These convinced me that a broader audience with an interest in Science & Technology (S&T) policy would find a brief analysis useful. What follows is therefore a short guide to what the new plan tells us about China’s technological direction. There are official translations of sessions and associated reports from the 14th National People’s Congress and ample commentary is available (for example from The International Institute for Strategic Studies (IISS)), though little that focusses exclusively on S&T. I cannot read Chinese, and I appreciate that subtle differences in framing are important, so I am relying on these secondary sources and accept the associated limitations.

The 15th 5-Year Plan runs to 2030. The document – the ‘Outline of the 15th Five-Year Plan for National Economic and Social Development of the People’s Republic of China’, was approved by the National People’s Congress early in March 2026. It is not the directive Soviet production schedule of my childhood recollection, China having adopted that model in the early 1950s but abandoned it in the 1990s. Despite this, the serried rows of apparatchiks at the Congress are a reminder of its roots.

[image is generated, check other images]

The 5-Year Plan is now best understood as a strategic coordination instrument, signalling to the party, to provinces, to ministries, and to the market about where resources will flow and what behaviours will be rewarded. It sets binding targets for only about a third of the plan’s 21 indicators, for the rest what matters is the direction of travel. This is in fact, a technology strategy document disguised as an economic plan.

Bert Hofman, a Fellow at the Mercator Institute for China Studies (MERICS), whose paper I commend highly, has provided a quick, and surprisingly revealing, method to gain an insight into the plan by word-counting across the 13th, 14th, and 15th plans. Artificial Intelligence leads the count, high-quality development comes second, scientific and technological innovation comes third. National security at fourth has been stable across all three plans at around twenty mentions. It is followed by industrial and supply chains. The signalling is not subtle.

The plan’s S&T framework has a clear internal hierarchy. At the apex sits what Xi Jinping calls ‘new quality productive forces’, a contemporary phrase with structural resonances from Marx, first deployed publicly in 2023, and now the organising ideology of Chinese industrial and innovation policy. Below that, the plan distinguishes three tiers: pillar industries, where China wants full-chain dominance now (integrated circuits, advanced computing, aerospace, biopharmaceuticals, and what is termed ‘the low-altitude economy’); emerging industries, where competition is being managed and destructive so-called ‘involution’ (or in plan terms ‘rat race competition’ exemplified by the EV sector where manufacturers raced to expand capacity and cut prices in order to capture market share thereby generating overcapacity, collapsing margins, and yielding loss-making at scale) is being curbed; and industries for the future – the frontier tier, comprising quantum technology, green hydrogen, embodied AI, brain-computer interfaces, 6G, biomanufacturing, and controlled nuclear fusion. Each tier has distinct institutional logic and, of course, different timescales.

The commitment to investment aligns with the ambition. R&D spending reached 2.8% of GDP in 2025, growing 9.1% in real terms. Central budget spending on S&T rises 10% in 2026. The plan commits to increasing the share going to basic research. This is notable because the report on the implementation of the 2025 plan admits, with unusual candour, that basic research fell short of target in 2025 with enterprises shifting toward applied work under commercial pressure. The acknowledgement itself reveals an attempt to rebalance the innovation system, pushing upstream.

The Zuchongzhi 3.0 quantum computer prototype and the EAST tokamak which, it is reported, sustained plasma at 100 million degrees for over 1,000 seconds, are referenced as flagship achievements. China ranked in the WIPO global innovation index (GII) top ten for the first time in 2025.

Beneath the innovation agenda lies a more significant strategic shift: a programme of what might be termed ‘dependency inversion’. The goal here is not solely self-reliance. It is rather, to reduce China’s exposures to the US and its partners whilst creating dependencies on China by everyone else. Rare earths have demonstrated how this might come about. The Chinese export controls of recent years were, in this context, not improvised responses to passing external pressures. They were rather the initial deployments of a capability that the 5-year plan is designed to sharpen and extend.

Military-civil fusion, a long-standing feature of China policy and planning, with deep roots in Communism (Xi Jinping chairs the Central Commission for Military-Civil Fusion Development), gets renewed emphasis. This is exemplified by a ‘green channel’, that is an expedited and preferential access route, for civilian participation in military S&T programmes, and calls for the sharing of resources and ‘production factors’ across sectors. Implicit acknowledgements that civil-military tech transfer is bureaucratically impeded. The technologies explicitly targeted under military-civil fusion are the same technologies on the 5-Year plan’s ‘industries for the future’ list. That overlap is not coincidental, they are not simply civilian technologies that could have military applications. They are dual-use technologies developed within an institutional framework intended to make the transfer seamless.

Critical minerals sit at the intersection of S&T policy, energy security, and geopolitical competition. The plan commits to stockpiling strategic minerals, deepening overseas exploitation, and managing the full chain of rare metal industries. Decarbonisation technologies critical to the energy transition are minerals-intensive: batteries, solar panels, wind turbines, and electrolysers (the devices that produce green hydrogen from water) all depend on materials whose processing China dominates.

The plan treats this green transition not as a necessary adaptation to climate pressures, though it is, but instead as a strategic technology domain. The carbon intensity indicator that replaces energy intensity as the binding environmental metric aligns with the sectors where China is building global industrial leads, thus solar photovoltaics, EVs, batteries, green hydrogen. High-tech product exports grew 13.2% in 2025 and power storage battery exports maintained double-digit growth. These are no longer low-quality goods competing on price. They are the outputs of an industrial policy 15 years in the making and now entering its consolidation phase. This is an important point to understand, rather than being a policy aspiration we must regard China’s competitive position as broadly established and extending.

There are many things, obviously, that the plan cannot fix. The technology-intensive sector remains a relatively small share of a $20 trillion economy. The much larger remainder, consumption, services, local government finance, real estate, faces problems the plan acknowledges but cannot, within its own ideologically-tinged logic, address. The general governmental deficit, including off-budget local government liabilities, runs close to 14% of GDP. Basic pensions for rural residents rose by 2%, well below projected GDP growth. The consumption rebalancing that economists have urged for a decade does not appear.

A fiscally-stressed but technologically and otherwise ambitious China is not a China that becomes less assertive. It is rather a China with stronger incentives to convert technological advantages into leverage rapidly, before structural problems accumulate further.

TL;DR The only question is ‘how big is the handcart’?

The Office for Students (OfS) is very concerned about the financial sustainability of universities. Not so concerned that they have considered reducing the regulatory burdens they impose, obviously. But concerned nonetheless. They are considering the details of the financial performance of each university. This is an extended technical process. I offer an alternative.

To make life easier for the OfS, @profserious has devised this simple test. Each of the attributes listed below has a threshold value. If the attribute is above the threshold it should be scored as 1 Dundee. 10 Dundees = 1 Full Peck. If your university scores 8 Dundees, or above, you should probably check your inbox for your redundancy notice – the terms will not be attractive.

• Number of Professors who aspire to be a Head of Department.
  (0, score 1 Dundee)

• Ratio of accountants to educators on University Council.
  (Above parity, score 1 Dundee)

• Number of buckets in the atrium of the science block.
  (3 buckets = 1 Vallance; 1 Vallance, score 1 Dundee)

• Number of overseas applicants for newly-launched ‘AI & Social Influencing’ (TikTok Studies) programme.
  (Less than half the number in the business model, score 1 Dundee)

• Number of fields in the Academic Workload Allocation Model
  (100, the point at which the model is no longer allocating workload but generating it, score 1 Dundee)

• Scale of inflated ambition in the India TNE business case.
  (Imperial, score 1 Dundee)

• Pallor of Chief Operating Officer (COO).
  (Grey, score 1 Dundee)

• Distance past sell-by date of biscuits at Academic Board.
  (Predate current Vice-Chancellor’s appointment, score 1 Dundee)

• Attractiveness of Voluntary Severance offer.
  (Attractive to anyone with options, score 1 Dundee)

• Proportion of lab equipment purchased prior to the last REF.
  (100%, the equipment has also outlasted 3 Heads of Department and 4 strategic plans, score 1 Dundee)

TL;DR UKRI’s restructuring of research funding is directionally correct, both necessary and consistent with what a national funding agency should be doing. The noise surrounding it reflects the stress of a sector under pressure from multiple directions, not a measured judgment on the merits of the changes. The task now is for the research community to engage constructively rather than assume the tone of an aggrieved Common Room, resentful of accountability.

There has been a kerfuffle. A kerfuffle is, in common parlance, a commotion, typically caused by someone making more of a situation than it warrants. It entails a degree of noise and agitation that is more than slightly disproportionate to the underlying issue. In this case, a public row on research funding that is undignified and has generated more heat than light. @profserious aims, as a matter of general principle, not to engage with ongoing kerfuffles, but in this case the commotion is damaging to the collective interest, unjustified and unjust, and I intend to respond.

The matter at issue concerns changes made by UKRI (the UK research and innovation funding agency) to the organisation and distribution of their funding support to the UK research and innovation ‘ecosystem’. The changes are attributed to the (relatively) recently appointed CEO of UKRI, Sir Ian Chapman, though - of course - the Council of UKRI, the Executive Chairs of the ‘constituent Councils’, and, at arms-length DSIT and the Minister, Lord Patrick Vallance, will each have been engaged.

Before I consider the changes I will make two framing observations that I believe are important. First, UK science has benefited from strong political support and has secured good funding settlements over an extended period. This against a background of stressed public funding and in the context of competing societal priorities. The ‘deal’ is that the research community will deliver on commitments to growth, prosperity and, increasingly security. We must honour the terms of that deal and therefore our funding needs to be organised accordingly.

Second, when UKRI was created many believed that the intent was to build a lightweight governance layer over the existing Councils, simplifying the oversight for what was then the Department of Business, Energy & Industrial Strategy (BEIS), now the responsibilities are with the Department for Science, Innovation and Technology (DSIT). There was some hope that UKRI would, over time, secure necessary, but essentially incremental, readjustments in the respective allocations to the Councils, which would then largely operate autonomously.

This idea that UKRI would simply preside over ‘business as usual’ was never sensible. The fact that this view persists in some corners is, to me, astonishing. UKRI is a national science funding agency, it was always clear that it would be expected to act strategically, deliver national priorities, respond to larger political imperatives. It was always clear that it would need to act as a unitary organisation. Even if this method of working was not an organisational necessity it would, in any case be required to pursue agendas across science and technology that are increasingly interdisciplinary and ‘systemic’.

So to the changes themselves. The following is a short summary.

There will be a restructuring of how UKRI allocates its budget for the 2026–2030 Spending Review period. Investment will be reorganised into three ‘buckets’: curiosity-driven research; strategic government and societal priorities; and support for innovative companies.

Where previously multiple councils run parallel programmes in the same field, UKRI will consolidate these into single cross-council programmes.

STFC (the Science and Technology Facilities Council) will be required to achieve cumulative savings of £162 million by the end of 2029–30. Rising energy costs and adverse currency movements have increased STFC’s annual costs by over £50 million, making a reset necessary even as its core budget holds broadly flat. Project leaders at STFC have been asked to model cuts of up to 60% on existing schemes, and staff have been warned to expect job losses.

MRC (Medical Research Council), BBSRC (Biotechnology and Biological Sciences Research Council), and EPSRC (Engineering and Physical Sciences Research Council) have each suspended several of their main funding routes during the transition.

Innovate UK will make a strategic pivot to support fewer companies but provide more intensive support to those selected. This has entailed suspension of the open Smart Grant scheme.

Before turning to the reactions these changes have provoked, it is worth noting that the science community is under broader stress that predates and is largely independent of these changes. Much of the relevant activity involves universities and academics, directly or indirectly. The HE sector is under extraordinary pressure. Research is structurally underfunded. The resources hitherto devoted to research, largely derived from overseas student fees, have had to be redirected to subsidise domestic student education. The need to keep the ‘show on the road’ has yielded larger workloads and continues to erode the time available for ‘unfunded’ research that supports the broader research enterprise. Larger uncertainties over jobs and disciplines form part of the picture, contributing to the atmospherics. Kerfuffles are most common when communities are under stress. The kerfuffle here is better understood as a symptom of that stress than as a measured response to the changes themselves.

There have been adverse reactions to these changes, variously expressed. From the physics and astronomy community who feel they must bear, disproportionately, the consequences of STFC costs. From those who are concerned that curiosity-driven research might lose out from a more strategically managed portfolio. And from those in the innovation community for whom changes lead to uncertainty and suggest a move away from SME support.

Whilst there is room for discussion about details, and as you might expect I have opinions, I believe that the proposals are directionally correct.

It is right that UKRI thinks holistically and strategically about the management of its research portfolio and the ‘buckets’ are a fair start.

It is right that cross-cutting and interdisciplinary research is brought together into UKRI operated programmes.

It is right that STFC bears the costs of its operations and meets the relevant budgetary constraints placed upon it. Bluntly, it is not right that other Councils (and disciplinary areas), EPSRC most notably, are called upon to make cuts towards the end of the financial year to meet overruns from STFC.

It is right that the open Smart Grant model, whatever its virtues for early-stage companies, is replaced by something more strategically focused. The argument that open competition reliably finds unexpected winners is real, but it is not a sufficient argument against prioritisation.

UKRI funding is complicated and, often not well understood. Though UKRI has a large budget, it also has very extensive forward commitments to grants and contracts awarded. Innovate UK funding has its own complexities and company spend patterns on programmes are difficult to estimate. The result of the funding arrangements is that even what would, in the long-run, be small changes have large short-term impacts as the bulk of prior commitments work through. Whilst I appreciate this provides limited comfort for individuals seeking to apply to current schemes that may have been suspended, we cannot allow this to lock us out of strategic change.

A slower, more incremental, approach could work to address the broader disruption these changes cause, but that assumes policy stability and political patience, and these are in short supply. This government expects us to show results and a determination to act on its priorities within the political cycle, and expects us to bear some pain in the process. UKRI is simply the messenger in this respect.

One objection deserves a direct response. The most substantive criticism from within the community concerns early-career researchers, that is postdocs and those on (effectively) fixed-term contracts who, in any period of transition, become the implicit shock absorbers of system-level adjustment. Unlike facilities or large programmes, early-career cohorts lost during a contraction cannot simply be rebuilt when conditions improve. This risk is real and UKRI should be explicit about the safeguards it intends to put in place. That said, it is an argument for careful implementation, not for abandoning the direction of travel.

It clearly has not helped that communications have gone somewhat awry. This featured in a House of Commons Science, Innovation and Technology committee, where Sir Ian Chapman was called to account. The communications failure was material, and it handed ammunition to critics who might otherwise have had less to work with. Earlier engagement with the community might possibly have helped. My instinct however, is that there is no viable communication strategy that would likely have made this change acceptable to the objectors. Nor would any further ‘transparency’ have assisted except to fuel further enquiry intended to derail change. Perhaps, a better sequencing of ‘good’ and ‘bad’ news could have achieved some damage limitation but would not have neutralised determined institutional opposition to changes of this scale. The volume of objection reflects the interests at stake, not simply the manner of announcement. The question now is whether the community’s response makes things better or worse. I have my view.

The approach of objectors poses a serious risk, particularly the institutional voices. The Spending Review was highly positive for research and innovation, at a moment when many public priorities and key services are compelled to implement significant savings. This seems to me to be a moment when ‘bad for science’, ‘bad for the UK’ rhetoric can seriously misfire. We must demonstrate a collective approach that recognises the responsibilities that we have taken on, and not assume the tone of aggrieved university Common Room, resentful of change.

We are exceptionally fortunate to have Sir Ian Chapman as the CEO of UKRI at a moment when complex but necessary changes must be delivered. He has political, scientific and managerial credibility. Seeing him manage the task of setting out the case with dignity, clarity and good humour is a lesson in effective communication. The job of CEO of UKRI is a highly demanding one. The set of stakeholders who must be aligned is large and their interests are various. We require the leadership he has demonstrated, and we need to invest it with our support. He has mine.

(@profserious was a member of the Council of UKRI, 2021-2024, and a member of Council of EPSRC, 2013-2018)

TL;DR National security strategies increasingly treat science and technology (S&T) as central to state power. A comparison of Russia, France, Germany and South Africa reveals a shared concern with technological dependency, and four very different attempts to resolve it. The themes that emerge, sovereignty, alliances, cyber, innovation, and critical materials, now shape the conditions under which science gets done.

A short while ago I set out ‘A Simple Guide to National Security Strategy’ which was essentially a head-to-head ‘compare and contrast’ account of the recently published UK, US and China National Security Strategies. I focussed, as you might imagine I would, on science and technology (S&T). This continued an established @profserious theme: that S&T are now increasingly at the centre of geopolitics and are a key domain of adversarial contest.

I have written since on areas such as ‘Technology & Sovereignty’. In the process, and in the light of more recent events, I have come to realise that my account of National Security Strategies was incomplete and that I should have looked beyond the UK, US and China.

Even if your interests are in broader geopolitics, I contend this is important and worth your attention. I appreciate that you may not regard government strategies as altogether compelling reading, hopefully I will spare you some of the hard work, and I firmly believe that the themes that emerge are interesting.

My initial plan was to extend the Guide to consider: Russia, as a key adversarial state; France and Germany, as capable S&T and industrial states and leading partners in Europe; and India as a large emerging non-aligned state.

It turns out however, that India does not have a published National Security Strategy, at least in that form - though attempts have been made to develop one. It should perhaps have been obvious to me that non-aligned countries, almost by definition, tend to be wary of publishing the kind of assertive strategic documents that, for example, NATO-aligned states produce. Those few states that do produce strategies adopt markedly different framings which, of course, is interesting in itself. For the purposes of this comparison I therefore selected South Africa, which not only has a strategy but one that has been recently published.

The four strategies reviewed are: the Russian Federation National Security Strategy signed by President Putin on 2 July 2021 as Presidential Decree No. 400, for which I use an unofficial English translation; Germany’s Integrated Security for Germany published on 14 June 2023, available in English; France’s National Strategic Review 2025 published on 14 July 2025 by the Secrétariat Général de la Défense et de la Sécurité Nationale, available in English; and South Africa’s National Security Strategy 2024–2029 adopted by Cabinet in March 2024 and published publicly in July 2025, available in a redacted form.

These are not all snapshots of the same world. Whilst the UK, US and China strategies were all published in 2025 - as are those of France and South Africa - Russia’s strategy was published in July 2021, before the full-scale invasion of Ukraine and before the sanctions, export controls and technology decoupling that have since reshaped its situation. Germany’s strategy, the first in its history, appeared in June 2023 and was shaped by the shock of that invasion.

Despite their differences in political system, alliance structure and economic capacity, the four strategies reveal a set of recurring themes in how states now think about S&T in national security. Five in particular stand out.

Technological sovereignty. The concept that recurs across all four strategies, in different vocabularies and with different inflections, is technological sovereignty - the desire not to be dependent on others for strategically critical capabilities.

France frames technological sovereignty as a precondition of strategic autonomy. Its 2025 National Strategic Review declares an ambition to achieve technological superiority across AI, space, quantum, biotechnology, directed energy, hypersonics and autonomous systems, and allocates significant funding specifically for AI and algorithmic development.

Germany frames sovereignty as resilience, that is, the capacity to absorb shocks when dependencies are disrupted. Its strategy was written in the immediate aftermath of Germany’s reckoning with dependence on Russian gas, and that experience saturates the document. It states directly that Germany’s resilience and competitiveness rest on innovative strength and technological and digital sovereignty, to be delivered across government, business, science and society as a whole.

Russia frames sovereignty as self-reliance under siege. The 2021 strategy advocates technological independence and import substitution, and asserts leading positions in aerospace, nuclear and information technologies. The document also, and significantly, drops commitment to international scientific links. The strategy anticipated external pressures (but perhaps not the speed or comprehensiveness with which technology decoupling would arrive).

South Africa frames sovereignty as independence, a developmental goal for a state that relies heavily on foreign technology across its public institutions and infrastructure. The strategy seeks to ensure that South Africa’s scientific and technological development is independent and competitive. The word independent carries real weight in the non-aligned tradition, signalling a refusal to become technologically dependent on any bloc. The strategy is candid that the gap between aspiration and reality is wide.

Alliances and partners. In S&T terms, who you collaborate with, who you share standards with, and whose technology ecosystem you build on are all security decisions. The four strategies reveal sharply different alliance logics.

France’s position is the most ambivalent. The 2025 strategy calls for a European defence technological and industrial base, but frames this primarily around French industrial capability as its foundation. France’s strategic autonomy doctrine has always been partly a hedge against dependence on any single partner, and the strategy is explicit that France must maintain the capacity for independent assessment and action. A significant novelty is France’s openness to strategic dialogue with European allies about the potential role of its nuclear deterrent in collective European defence, which has direct implications for the technologies and systems around which European security cooperation is organised.

Germany is the most alliance-dependent of the four in S&T terms and is explicit about it. Its strategy frames technological and digital sovereignty as something to be achieved within European and NATO frameworks rather than unilaterally. The EU economic security strategy, the NIS2 directive and collaborative approaches to critical technology are all treated as delivery mechanisms. Germany’s S&T security posture is therefore substantially shaped by decisions taken collectively rather than nationally.

Russia’s alliance picture has inverted. The 2021 strategy positions China and India as the primary technology partners, with BRICS and the SCO as the institutional vehicles. The dropping of the 2015 strategy’s (https://www.russiamatters.org/node/21421) commitment to international scientific links signals the effective end of meaningful scientific partnership with the West, though the document does not say so in those terms. The strategy envisions technological self-sufficiency supported by eastern partnerships rather than western collaboration.

South Africa treats multilateral ambiguity as a deliberate strategy. It is simultaneously a BRICS member, a significant partner of the EU and a participant in Western scientific collaboration. Its strategy presents this not as a contradiction but as an expression of the non-aligned principle of maintaining relationships with all parties as a condition of genuine independence. In S&T terms this means South African researchers and institutions are positioned across multiple ecosystems simultaneously. As technology blocs harden and partner-vetting requirements tighten, the strategy acknowledges that sustaining this position will require active management.

Information and cyber. All four strategies treat cyber as a significant security domain. The surface similarity conceals however a conceptual divergence that is one of the most important fault lines in thinking about national security.

Russia’s strategy elevates the priority of information security, but the framing is not primarily technical. The concern is with foreign platforms, sovereign internet vulnerability and what the document calls information confrontation with the West. Large platforms are characterised as instruments spreading false information and threatening Russian sovereignty. The response set out in the strategy is a sovereign internet ‘segment’, capabilities for information confrontation, and control of the domestic digital and cognitive environment. It treats the information space as a domain of active contest in both directions.

France is the most operationally specific, identifying AI-enabled attacks, sabotage of deep-sea cables and energy infrastructure, and interference targeting universities and research institutions as priority threats. It notes that French universities and laboratories have been specifically targeted by foreign interference aimed at talent capture and knowledge theft, a concern the strategy treats as a frontline security issue rather than a peripheral one. Both offensive and defensive cyber capabilities are explicitly within scope.

Germany’s strategy describes cybersecurity as a joint task of state, business, science and society. It is cooperative and societal in framing rather than operational and adversarial, reflecting the integrated security philosophy of the document as a whole. The strategy identifies ransomware as a particular threat to critical infrastructure and public institutions, and commits to developing cybersecurity architecture in partnership with the private sector.

South Africa’s strategy elevates cyber to a counter-intelligence priority for the first time. The emphasis is on building foundational forensic and defensive capability, strengthening vulnerability assessments across state-owned enterprises, and addressing cybersecurity weaknesses in procurement and supply chains.

Innovation gap. Every strategy claims S&T ambition. The strategies themselves, with varying degrees of candour, acknowledge the gap between ambition and delivery.

France’s strategy asserts that Europe faces the risk of a dual decline in growth and research and development. It commits significant resources for the period 2024–2030. The strategy identifies compute capacity as the main acknowledged gap and presents France’s nuclear-heavy electricity system as a strategic asset for energy-intensive AI infrastructure.

Germany’s strategy commits to investment in critical infrastructure protection, cyber capabilities and the innovative strength of the business and research sectors. It acknowledges that one-sided dependencies in strategically relevant areas have developed into security risks, and that reducing them will require sustained investment. The strategy does not however specify funding levels for S&T.

Russia’s strategy, implausibly, asserts competitive strength across a range of technologies but is less specific about the investment required to sustain or build it. It calls for increasing spending on science and technology to the levels of leading countries and creating a state management system for science, technology and innovation, but offers little detail on how these goals are to be achieved or resourced. The contrast with the 2015 strategy, which was more candid about structural weaknesses in the innovation system, is notable.

South Africa’s strategy is the most frank of the four about the distance between aspiration and capacity. It acknowledges its capabilities as severely degraded and prior defence reviews as largely unimplemented due to funding constraints. South Africa spends less than 1% of GDP on R&D, below the African Union’s own target, and the strategy presents the science and technology base as a priority for development rather than an existing strength to be protected.

Critical materials and energy transition. The green transition and geopolitical competition over critical materials are not separate trends. They are entangled in ways that create direct security implications for S&T.

France makes the entanglement explicit. Its 2025 strategy identifies China’s control of the bulk of global rare earth refining capacity as a direct strategic vulnerability and notes that adaptation to climate change is itself driving increased demand for precisely those materials that are already the subject of open geopolitical competition. The strategy also notes that global energy consumption is increasing, driven in part by the development of new technologies, and that this is generating additional demand for uranium alongside renewables and electro-mobility. Securing critical mineral supply chains is presented as simultaneously climate policy and security policy.

Germany’s strategy frames the reduction of one-sided dependencies in energy and raw materials as a core security imperative, drawing directly on the experience of energy dependence on Russia. It notes that the climate crisis is already having security implications and commits to ensuring the sustainable use of natural resources as part of its integrated security approach.

Russia’s strategy takes, as you might imagine, a structurally different position. It is a major producer of critical materials and energy resources rather than a dependent consumer, and treats this as a strategic asset. The strategy commits to building strategic mineral reserves and developing new high-technology sectors of the economy, framing resource wealth as a foundation for technological development rather than a vulnerability.

South Africa’s position is the most paradoxical. It is one of the world’s most significant sources of platinum group metals, manganese and chromium, materials that appear in the critical minerals lists of every major Western and Chinese strategy. Yet its own NSS does not frame these resources as strategic assets in security terms. This reflects the non-aligned posture that to weaponise resource leverage would be to choose sides in contests South Africa prefers to navigate rather than join. Whether that posture remains sustainable as competition over critical materials intensifies is an open question.

The ‘Simple Guide’ reinforced my contention that S&T are no longer adjacent to national security but central to it. These four strategies further confirm and deepen that contention from positions that could hardly be more different: an adversarial state asserting technological self-sufficiency whilst managing deepening isolation; two major European industrial democracies building sovereign capability within alliance frameworks; and a non-aligned emerging economy attempting to stay open to all parties while reducing its vulnerability to any of them.

The five themes identified here - technological sovereignty, alliances and partners, information and cyber, the innovation gap, and the entanglement of critical materials with the energy transition - are not policy abstractions. They show up in decisions about research funding, collaboration agreements, export licences, infrastructure procurement and institutional partnerships.

Understanding these strategies is not about adopting a particular geopolitical position. It is about recognising the strategic environment in which science and technology now operate and shedding illusions. For scientists and technologists this environment is no longer peripheral. It increasingly shapes the conditions under which research is undertaken, collaborations are permitted, and technologies are deployed.

TL;DR The UK’s three-year Bachelor’s degree is largely a historical artefact and merits serious reconsideration. A 2+2 model, two years to a first degree followed by an optional two-year integrated Master’s, could deliver the same learning more efficiently whilst improving access, flexibility and international alignment. It would require system-level change, but it would address many current concerns in higher education.

In 1729 the great Anglo-Irish satirist Jonathan Swift wrote a satirical essay, A Modest Proposal for Preventing the Children of Poor People from Being a Burden to Their Parents or Country, and for Making Them Beneficial to the Publick. In it he argued, hardly ‘modestly’, that impoverished families should sell their babies as food for the wealthy. You probably cannot, for even one moment, imagine why I believe this has resonances with current debates on Higher Education. Do not worry, no culinary suggestions will follow. What follows instead is my ‘modest proposal’ for the structure of the undergraduate degree.

There has been a great deal of discussion about the current challenges in Higher Education. Much of that discussion focuses on access, participation, graduate outcomes, funding and the broader shape of the sector. And, as you know, I have views on all of these things, and much else besides. Surprisingly, however, relatively little of this debate concerns the more basic matter of what we actually teach and how that teaching is organised. In particular we have, I argue, paid minimal attention to our basic ‘product’, the three-year undergraduate ‘Bachelor’s’ degree. I believe it is a product that merits serious rethinking.

My modest proposal is simply this. The UK should move to a ‘2+2’ system of integrated undergraduate and postgraduate education. In this system we would have a two-year first degree (if you insist on an alternative title ‘Associate Degree’, ‘Diploma’, or perhaps even the pleasingly historical ‘Licentiate’) followed by an integrated two-year Master’s degree for those who continue.

I envisage that, through more compressed and more deliberate teaching structures, at least in Years 1 and 2, we could effectively cover the Level 6 learning outcomes (education-sector jargon for degree-level attainment) currently associated with a Bachelor’s degree. Most UK undergraduate degrees are nominally 30 weeks per year. In reality, with a lighter exam-focused Summer term, they are more like 27 + 27 + 25 weeks, a total of roughly 79 teaching weeks. A two-year programme of 40 + 40 weeks, a total of 80 weeks, could cover essentially the same ground, albeit in a more continuous and intentional manner. There is scope, particularly with ed-tech, to use the teaching-day more efficiently.

After the two-year programme, graduates could exit with a recognised Level 6 qualification and enter the workforce, perhaps by way of additional professional or work-based training. Alternatively, and assuming suitable attainment, they could progress to a professionally accredited two-year integrated Master’s programme. If we assume an extended academic year there would be scope for structured work placements, international mobility, and a substantial experiential project or advanced dissertation. Entry could be directly to the four-year 2+2 pathway, with an option to exit after two years, or to a two-year first-degree programme in the first instance.

While we are at it, we could also simplify and regularise the current rather baroque systems of assessment and programme structure that prevail in many UK institutions and where much cost and operational complexity resides. Most comparable international systems manage perfectly well without them.

The UK model is already something of an international outlier. In the United States the standard first degree is four years (with a shorter and less specialised secondary education). Across much of continental Europe the Bologna structure is typically three years for a Bachelor’s degree followed by two years for a Master’s. Scotland already operates a four-year undergraduate degree (three-year degrees for students entering with Advanced Highers). Against this backdrop a two-year first degree followed by a two-year Master’s would not be particularly radical. It would simply be another way of organising the same volume of higher learning. It is worth noting that the UK has already flirted with a related idea. In recent years governments have fitfully encouraged ‘accelerated degrees’, essentially compressing the traditional three-year programme into two more intensive years. A small number of institutions have experimented with this model. The difficulty is that these initiatives largely attempt to squeeze the existing structure into a shorter timeframe without wider structural and systemic adaptation. What I am suggesting is something rather different, a reorganisation of the degree itself.

The existing UK one-year intensive Master’s could remain as a supplementary or complementary qualification, particularly for career conversion or specialist postgraduate study.

The advantages of this approach are obvious:

• Students graduating at Level 6 are out of the workforce for a shorter period, and accumulate less debt in the process.

• It supports access and participation, lowering both the time and financial barriers associated with a first degree.

• There is scope for mobility between universities (and perhaps between programmes), increasing choice and creating greater differentiation within the university system. This drives system change.

• It is more closely aligned with international models that already deliver ‘undergraduate Master’s’ pathways.

• It could appeal to global students, particularly those seeking more flexible progression routes and a more cost-effective option.

• It supports the extended learning required for professional courses.

• Workplace learning and placements fit more naturally within this structure.

• Increasingly, Master’s degrees have become a paid-for access route to ‘graduate’ jobs, inhibiting access for those without recourse to family resources.

• It uses university facilities and resources more efficiently across the year.

• It gives us an opportunity to rethink pedagogy and delivery, and to re-orient teaching around more authentic, applied and experiential approaches to learning.

The disadvantages are equally obvious:

• It is unlikely to happen! The system is highly conservative, and structural change in universities occurs only slowly, and usually reluctantly.

• It requires system-level change. No single institution can drive it alone.

• Even if the bulk of institutions, and students, wanted it, the narrow stratum of so-called ‘prestigious universities’, who have little motivation to see the system change, will likely deploy their reputational capital to stand apart from the reform and, by doing so, block it.

• It might be difficult to persuade people that shorter and more intensive programmes can secure learning outcomes comparable to the traditional model.

• There is also a reasonable argument that intellectual maturation and the absorption of complex ideas require time as well as intensity. University is also about an extended social and intellectual experience.

• Such a change would place real demands on the academic workforce, and would require adjustments in patterns of work and the organisation of university services. In particular, careful attention would be required to protect the connected time necessary for research and scholarship.

So why make such a proposal at all? Because the present model is not the product of timeless academic wisdom. It is largely an historical artefact, a structure that emerged under very different economic, social and institutional conditions. If the pressures currently bearing down on Higher Education teach us anything, it is that we should occasionally revisit our most basic assumptions. Swift’s proposal was never intended to be adopted. Mine, perhaps improbably, might actually solve a few problems.